CVE-2020-9494

Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to allocate a large amount of memory and spin the thread.

• CWE-770

• http://www.openwall.com/lists/oss-security/2021/03/01/2Not Applicable
• https://lists.apache.org/thread.html/rf7f86917f42fdaf904d99560cba0c016e03baea6244c47efeb60ecbe%40%3Cdev.trafficserver.apache.org%3EMailing List, Vendor Advisory
• https://www.debian.org/security/2020/dsa-4710Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/03/01/2Not Applicable
• https://lists.apache.org/thread.html/rf7f86917f42fdaf904d99560cba0c016e03baea6244c47efeb60ecbe%40%3Cdev.trafficserver.apache.org%3EMailing List, Vendor Advisory
• https://www.debian.org/security/2020/dsa-4710Third Party Advisory

Published

Jun 24, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-9488Improper validation of certificate with host mismatch in Apa…3.7
• CVE-2020-9489A carefully crafted or corrupt file may trigger a System.exi…5.5
• CVE-2020-9490Apache HTTP Server versions 2.4.20 to 2.4.43. A specially cr…7.5
• CVE-2020-9491In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were pro…7.5
• CVE-2020-9492In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and …8.8
• CVE-2020-9493A deserialization flaw was found in Apache Chainsaw versions…9.8
• CVE-2020-9495Apache Archiva login service before 2.2.5 is vulnerable to L…5.3
• CVE-2020-9496XML-RPC request are vulnerable to unsafe deserialization and…6.1
• CVE-2020-9497Apache Guacamole 1.1.0 and older do not properly validate da…4.4
• CVE-2020-9498Apache Guacamole 1.1.0 and older may mishandle pointers invo…6.7
• CVE-2020-9499Some Dahua products have buffer overflow vulnerabilities. Af…7.2
• CVE-2020-9500Some products of Dahua have Denial of Service vulnerabilitie…4.9