{"id":"CVE-2021-44040","state":"PUBLISHED","title":"HTTP request line fuzzing attacks","description":"Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1.","publishedAt":"2022-03-23T14:05:15.000Z","updatedAt":"2024-08-04T04:10:17.217Z","severity":null,"assigner":"apache","products":["Apache Software Foundation Apache Traffic Server"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Traffic Server","versions":[{"version":"8.0.0 to 8.1.3 and 9.0.0 to 9.1.1","status":"affected"}]}],"references":["https://lists.apache.org/thread/zblwzcfs9ryhwjr89wz4osw55pxm6dx6","https://www.debian.org/security/2022/dsa-5153"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T19:49:10.699Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/44xxx/CVE-2021-44040.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-44040","state":"PUBLISHED","datePublished":"2022-03-23T14:05:15.000Z","dateUpdated":"2024-08-04T04:10:17.217Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2021-11-19T00:00:00.000Z"},"containers":{"cna":{"title":"HTTP request line fuzzing attacks","descriptions":[{"lang":"en","value":"Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1."}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Traffic Server","versions":[{"version":"8.0.0 to 8.1.3 and 9.0.0 to 9.1.1","status":"affected"}]}],"references":[{"url":"https://lists.apache.org/thread/zblwzcfs9ryhwjr89wz4osw55pxm6dx6","tags":["x_refsource_MISC"]},{"url":"https://www.debian.org/security/2022/dsa-5153","name":"DSA-5153","tags":["vendor-advisory","x_refsource_DEBIAN"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"apache","dateUpdated":"2022-05-31T10:06:44.000Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09"},"credits":[{"lang":"en","value":"Apache Traffic Server would like to thank Bahruz Jabiyev, Steven Sprecher and Kaan Onarlioglu for reporting these issues.  We used his tool t-reqs (https://github.com/bahruzjabiyev/t-reqs-http-fuzzer) for discovering them."}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.0.9"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@apache.org","ID":"CVE-2021-44040","STATE":"PUBLIC","TITLE":"HTTP request line fuzzing attacks"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Apache Traffic Server","version":{"version_data":[{"version_value":"8.0.0 to 8.1.3 and 9.0.0 to 9.1.1"}]}}]},"vendor_name":"Apache Software Foundation"}]}},"credit":[{"lang":"eng","value":"Apache Traffic Server would like to thank Bahruz Jabiyev, Steven Sprecher and Kaan Onarlioglu for reporting these issues.  We used his tool t-reqs (https://github.com/bahruzjabiyev/t-reqs-http-fuzzer) for discovering them."}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":[{}],"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-20 Improper Input Validation"}]}]},"references":{"reference_data":[{"name":"https://lists.apache.org/thread/zblwzcfs9ryhwjr89wz4osw55pxm6dx6","refsource":"MISC","url":"https://lists.apache.org/thread/zblwzcfs9ryhwjr89wz4osw55pxm6dx6"},{"name":"DSA-5153","refsource":"DEBIAN","url":"https://www.debian.org/security/2022/dsa-5153"}]},"source":{"discovery":"UNKNOWN"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread/zblwzcfs9ryhwjr89wz4osw55pxm6dx6","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.debian.org/security/2022/dsa-5153","name":"DSA-5153","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T04:10:17.217Z"}}]}}}