CVE-2024-50305

What it actually does

A specially crafted but valid Host header triggers a crash in Apache Traffic Server on certain platforms due to improper handling during request processing.

Why it matters to the business

Service availability is disrupted as the proxy or caching layer becomes unresponsive, leading to downtime for dependent applications and potential loss of traffic handling capacity until restart.

How an attack unfolds

An attacker sends an HTTP request containing a valid but maliciously formatted Host header to an affected Apache Traffic Server instance; the server fails to process it correctly and terminates, resulting in a denial of service. No authentication or complex setup is required.

How to fix it

Upgrade Apache Traffic Server to version 9.2.6 or 10.0.2. For the GIT repository, apply the fix from commit de3e58726f6f58a95266a41eaa31ff3c6fc14336. Apply the listed kernel and package updates for affected Ubuntu releases where Traffic Server is deployed.

How to confirm the fix worked

After upgrade, confirm the running version reports 9.2.6 or higher; test with representative Host header requests to verify the process no longer crashes; review release notes for the fix commit.

Typical attack path

1. Identify an exposed Apache Traffic Server instance running versions 9.2.0-9.2.5
2. Craft an HTTP request with a valid Host header field designed to trigger the crash condition
3. Send the request to the server
4. Observe server process termination and service unavailability

How to detect it

Monitor system and application logs for unexpected Traffic Server process crashes or restarts coinciding with incoming HTTP requests; correlate with proxy access logs showing Host header values around the time of failure.

What your security team should do

• Prioritize upgrade of all Apache Traffic Server instances to 9.2.6 or 10.0.2 within maintenance windows
• Inventory deployments to identify any remaining 9.2.0-9.2.5 versions
• Implement process monitoring and automatic restart for the Traffic Server service as a temporary control
• Review network exposure and apply access controls to limit untrusted Host header traffic if upgrade is delayed