Apache Traffic Server: heap-buffer-overflow via HTTP Host header (unbounded alloca pattern, 5 sites)

Apache Traffic Server: heap-buffer-overflow via HTTP Host header (unbounded alloca pattern, 5 sites) — 90-day disclosure

Reported by oss-security

Summary by Cyber Security News3 Nov 2026, 20:51 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/480

Posted by feng on Nov 03 Apache Traffic Server: heap-buffer-overflow via HTTP Host header (unbounded alloca pattern, 5 sites) — 90-day disclosure Reporter: Innora Security Research (feng () innora ai) Target: Apache Traffic Server master (verified on HEAD

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

A Hybrid Approach for Automated Security Pattern Recovery

PIMROP: A Feasibility Study of Return-Oriented Programming on Commercial Processing-in-Memory Architectures

Towards Early Warning of Real-World Vulnerabilities: An Evidence-Aware Decoupled Method for CVSS Vector Prediction Based on Unstructured Disclosures

CVE-2026-109518: RCE in apt(1) (DSA 6607-1)

Hugging Face’s CEO Says His P(Doom) Is ‘Close to Zero’

Building on open source AI? Hugging Face’s policy chief on the costs, risks, and trade-offs