Inconsistent interpretation of HTTP requests in Apache Traffic Server - CVE-2026-111816
Published: October 23, 2026
Vulnerability identifier: #VU157325
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-111816
CWE-ID: CWE-444
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to poison the cache and desynchronize HTTP response framing.
The vulnerability exists due to improper rejection of malformed HTTP responses in Apache Traffic Server when the Transfer-Encoding: chunked exception bypasses parse-error rejection for a malformed 302 response. A remote attacker can supply a crafted response that peers interpret differently and that Traffic Server forwards, stores, and serves to poison the cache and desynchronize response framing.
Affected software
Apache Traffic Server
How to mitigate CVE-2026-111816
Install security update from vendor's website.
Apache Traffic Server - addressed in versions 9.2.16, 10.1.5, 10.2.1