CVE-2024-56202: 
Apache Traffic Server vulnerability analysis and mitigation

Expected Behavior Violation vulnerability was discovered in Apache Traffic Server. The vulnerability affects Apache Traffic Server versions from 9.0.0 through 9.2.8 and from 10.0.0 through 10.0.3. The issue is specifically related to the Expect header field that can unreasonably retain resources (Apache List, NVD).

The vulnerability has been classified as CWE-440 (Expected Behavior Violation). According to the CISA-ADP assessment, it has received a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, indicating a network-accessible vulnerability with low attack complexity requiring low privileges and no user interaction (NVD).

The vulnerability affects the availability of the system, as indicated by the CVSS vector string showing impact to availability (A:L) while having no impact on confidentiality (C:N) or integrity (I:N) (NVD).

The vulnerability is network accessible (AV:N) with low attack complexity (AC:L) and requires low privileges (PR:L) to exploit. No user interaction (UI:N) is needed to exploit this vulnerability (NVD).

Users are recommended to upgrade to Apache Traffic Server versions 9.2.9 or 10.0.4 or newer, which contain fixes for this vulnerability. For 9.x users, the upgrade path is to version 9.2.9 or later, while 10.x users should upgrade to version 10.0.4 or later (OSS Security, NVD).