CVE-2023-39456: Apache Traffic Server HTTP/2 frame input validation flaw causes denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote, unauthenticated denial of service with a 7.5 CVSS score and very high EPSS percentile, though no confirmed in-the-wild exploitation is recorded.

What it is

Apache Traffic Server versions 9.0.0 through 9.2.2 fail to properly validate malformed HTTP/2 frames, an improper input validation weakness (CWE-20). A remote, unauthenticated attacker can send crafted HTTP/2 traffic that disrupts the service, making this a denial-of-service concern for exposed proxies and caches.

Impact

The attacker can cause a denial of service against the Traffic Server process, degrading or halting HTTP/2 traffic handling. The CVSS vector shows availability impact only, with no confidentiality or integrity loss.

Attack surface

Reachable over the network via the HTTP/2 listener (AV:N, PR:N, UI:N), so no authentication or user interaction is required. Any Traffic Server instance accepting HTTP/2 connections from untrusted clients is exposed.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at roughly 0.54 (98.9th percentile), indicating elevated predicted exploitation likelihood.

What to do

• Upgrade Apache Traffic Server to 9.2.3 or later, which the vendor states fixes the issue.
• Apply the vendor and distribution updates (Fedora package announcements, Debian DSA-5549) where Traffic Server is packaged.
• If immediate patching is not possible, restrict or disable HTTP/2 on internet-facing listeners and require HTTP/1.1 until upgraded.
• Limit network exposure of Traffic Server HTTP/2 endpoints to trusted clients and place rate limiting or a filtering proxy in front.
• Monitor vendor advisories for backported fixes to maintained release branches.

Detection

• Alert on Traffic Server crashes, restarts or abnormal process exits correlated with HTTP/2 traffic.
• Inspect HTTP/2 traffic logs and packet captures for malformed or protocol-violating frames reaching the server.
• Baseline normal HTTP/2 frame patterns and flag anomalies such as unexpected frame types or sizes from single sources.
• Track availability metrics and error rates on Traffic Server HTTP/2 listeners for sudden degradation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.