CVE-2026-111817Medium· 5.3▾ SunlitApache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out, because it waits for the trailer bytes it has already dropped. …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on by default in 10.x. In 8.1.11 and 9.2.x it is off by default, and those versions are affected only if it is enabled.
This issue affects Apache Traffic Server: 8.1.11, from 9.2.5 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.
apache_traffic_server 8.1.11apache_traffic_server >= 9.2.5 <= 9.2.15apache_traffic_server >= 10.0.0 <= 10.1.4apache_traffic_server 10.2.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111805High· 8.6Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion
CVE-2026-111810High· 7.5Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service
CVE-2026-111815Critical· 10.0Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement
CVE-2026-111808High· 8.6Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion
CVE-2026-111809Critical· 9.3Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling
CVE-2026-111814Critical· 10.0Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin