Live › vulnerability › CVE-2026-111805
Go to dashboardApache Traffic Server forwards a truncated Content-Length from HTTP/2 clients to HTTP/1.1 origins, which can leave origin workers waiting. An attacker can exhaust the origin's worker pool and cause denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed Traffic Server version (traffic_server -V or the package manager) and see whether it falls in 8.0.0-8.1.11, 9.0.0-9.2.15, 10.0.0-10.1.4, or 10.2.0.
Upgrade to 9.2.16, 10.1.5, or 10.2.1, matching your major line.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-111805")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.