CVE-2015-3249

Critical

Published: 30/10/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or possibly execute arbitrary code via vectors related to the frame_handlers array or set_dynamic_table_size function.

Risk Assessment

Attackers may exploit this vulnerability to disrupt server operations or execute malicious code, potentially leading to serious security implications for the organization.

Recommendation

It is recommended to upgrade Apache Traffic Server to version 5.3.1 or later to mitigate this vulnerability.

Original NVD description (English source)

The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or possibly execute arbitrary code via vectors related to the (1) frame_handlers array or (2) set_dynamic_table_size function.