CVE-2021-27577: 
Apache Traffic Server vulnerability analysis and mitigation

Incorrect handling of url fragment vulnerability (CVE-2021-27577) in Apache Traffic Server allows an attacker to poison the cache. This vulnerability affects Apache Traffic Server versions 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, and 9.0.0 to 9.0.1. The vulnerability was disclosed in June 2021 and received a CVSS v3.1 base score of 7.5 (HIGH) (NVD).

The vulnerability is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests) and received a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating network accessibility, low attack complexity, no privileges required, no user interaction needed, and high impact on integrity (NVD).

The vulnerability allows attackers to perform cache poisoning attacks against Apache Traffic Server installations. This can lead to serving malicious or incorrect content to users requesting legitimate resources (NVD).

The vulnerability is remotely exploitable with no authentication required and low attack complexity. No specific exploit details or reports of exploitation in the wild were found in the available sources.

The vulnerability has been addressed in subsequent releases of Apache Traffic Server. Debian has released security updates to address this vulnerability in DSA-4957-1 for affected versions (Debian Advisory).