VulnerabilityModified

CVE-2023-39456

Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2.

HIGH 7.5EPSS 58.3%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 58.3%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 9.2.3, which fixes the issue.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 58.29% probability · 99th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-20
Affected: apache/traffic server · fedoraproject/fedora
Source: security@apache.org

EPSS trend

EPSS moved from 60.5% on 12 October 2026 to 58.3% on 3 November 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.