High
Security advisory
There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when interacting with upstream proxies and the wrong host being used.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-5660
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 05:32 UTC · Revision 1
Source evidence
There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when interacting with upstream proxies and the wrong host being used.
osv:CVE-2017-5660
Complete source record
{
"id": "005047b50624e533fded066293a1d2bbc5bfba9c8a857487013fe23db04a2e18",
"url": "https://osv.dev/vulnerability/CVE-2017-5660",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-5660",
"summary": "There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when interacting with upstream proxies and the wrong host being used.",
"evidence": "osv:CVE-2017-5660",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2017-5660",
"aliases": [
"CVE-2017-5660"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/trafficserver",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "a57be23251358e6ac97442ebde3dae8d95d94846"
},
{
"introduced": "6d6c6f2af903c3c2d1dec7db8094d00cb1813e60"
},
{
"last_affected": "5a27a40000db0b8f8edee7e99cd65ecb710239b2"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "6.2.0"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:traffic_server:6.2.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "6.2.1"
},
{
"last_affected": "6.2.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:traffic_server:6.2.1:rc0:*:*:*:*:*:*",
"range": [
{
"introduced": "6.2.1-rc0"
},
{
"last_affected": "6.2.1-rc0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:traffic_server:6.2.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "6.2.2"
},
{
"last_affected": "6.2.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:traffic_server:6.2.2:rc0:*:*:*:*:*:*",
"range": [
{
"introduced": "6.2.2-rc0"
},
{
"last_affected": "6.2.2-rc0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:traffic_server:7.0.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.0"
},
{
"last_affected": "7.0.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:traffic_server:7.0.0:rc0:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.0-rc0"
},
{
"last_affected": "7.0.0-rc0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:traffic_server:7.0.0:rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.0-rc1"
},
{
"last_affected": "7.0.0-rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:traffic_server:7.0.0:rc2:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.0-rc2"
},
{
"last_affected": "7.0.0-rc2"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"6.2.1",
"6.2.2",
"7.0.0",
"7.0.0-rc0",
"7.0.0-rc1",
"7.0.0-rc2",
"6.2.0-rc3",
"6.2.0",
"6.2.0-rc2",
"6.2.0-rc1",
"6.2.0-rc0",
"3.3.1",
"3.3.0",
"3.1.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-5660.json"
}
}
],
"modified": "2026-10-24T10:30:30.026834494Z",
"provider": "osv",
"references": [
"https://lists.apache.org/thread.html/22d84783d94c53a5132ec89f002fe5165c87561a9428bcb6713b3c98%40%3Cdev.trafficserver.apache.org%3E",
"https://www.debian.org/security/2018/dsa-4128"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2017-5660",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 432479,
"published_at": "2018-02-27T20:29:00.403+00:00"
}