GHSA-f2wr-c4c4-xjg7

Suggest an improvement
Source
https://github.com/advisories/GHSA-f2wr-c4c4-xjg7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f2wr-c4c4-xjg7/GHSA-f2wr-c4c4-xjg7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-f2wr-c4c4-xjg7
Aliases
Published
2022-05-13T01:09:17Z
Modified
2025-07-09T15:40:27Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Apache Traffic Control vulnerable to Slowloris-style Denial of Service attack
Details

The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections made on the configured DNS port will remain in the ESTABLISHED state until the client explicitly closes the connection or Traffic Router is restarted. If connections remain in the ESTABLISHED state indefinitely and accumulate in number to match the size of the thread pool dedicated to processing DNS requests, the thread pool becomes exhausted. Once the thread pool is exhausted, Traffic Router is unable to service any DNS request, regardless of transport protocol.

Database specific 
{
    "cwe_ids":  [
        "CWE-400"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-04-24T21:47:30Z",
    "nvd_published_at":  "2017-07-10T18:29:00Z",
    "severity":  "HIGH"
}
References

Affected packages

Go
github.com/apache/trafficcontrol

Package

Name
github.com/apache/trafficcontrol
View open source insights on deps.dev
Purl
pkg:golang/github.com/apache/trafficcontrol

Affected ranges

Type
SEMVER
Events
Introduced
1.1.4
Fixed
1.8.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f2wr-c4c4-xjg7/GHSA-f2wr-c4c4-xjg7.json"
github.com/apache/trafficcontrol

Package

Name
github.com/apache/trafficcontrol
View open source insights on deps.dev
Purl
pkg:golang/github.com/apache/trafficcontrol

Affected ranges

Type
SEMVER
Events
Introduced
2.0.0-RC0
Fixed
2.0.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f2wr-c4c4-xjg7/GHSA-f2wr-c4c4-xjg7.json"
github.com/apache/trafficcontrol

Package

Name
github.com/apache/trafficcontrol
View open source insights on deps.dev
Purl
pkg:golang/github.com/apache/trafficcontrol

Affected ranges

Type
SEMVER
Events
Introduced
2.1.0-RC0
Fixed
2.1.0-RC1

Affected versions

2.*
2.1.0-RC0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f2wr-c4c4-xjg7/GHSA-f2wr-c4c4-xjg7.json"
github.com/apache/trafficcontrol

Package

Name
github.com/apache/trafficcontrol
View open source insights on deps.dev
Purl
pkg:golang/github.com/apache/trafficcontrol

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.0.0-20170531185407-738c10fa1b58

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f2wr-c4c4-xjg7/GHSA-f2wr-c4c4-xjg7.json"
github.com/apache/trafficcontrol

Package

Name
github.com/apache/trafficcontrol
View open source insights on deps.dev
Purl
pkg:golang/github.com/apache/trafficcontrol

Affected ranges

Type
SEMVER
Events
Introduced
0.0.0
Fixed
1.1.4-0.20170531185407-738c10fa1b58

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f2wr-c4c4-xjg7/GHSA-f2wr-c4c4-xjg7.json"