Apache Traffic Server: HTTP Host头堆溢出漏洞修复

Apache Traffic Server: heap-buffer-overflow via HTTP Host header (unbounded alloca pattern, 5 sites) — 90-day disclosure

推荐理由

核心代理组件存在可利用的远程内存破坏漏洞，直接影响线上服务安全，需尽快评估升级或应用临时缓解措施。

Posted by feng on Nov 03

Apache Traffic Server: heap-buffer-overflow via HTTP Host header

(unbounded alloca pattern, 5 sites) — 90-day disclosure

Reporter: Innora Security Research (feng () innora ai)

Target: Apache Traffic Server master (verified on HEAD <= 82605c6 at report

time; pattern still present on master as of 2026-11-03, HttpTransact.cc:1573)

Weakness: CWE-787 Out-of-bounds Write (heap-buffer-overflow, ASAN-verified)

Companion: CWE-789 Memory Allocation...

看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力