Live › vulnerability › CVE-2026-111808
Go to dashboardA client can send a malformed padded HTTP/2 DATA frame to Apache Traffic Server. The padding underflows (CWE-191) and ATS allocates many backend worker threads on the HTTP/1.1 origin, exhausting its worker pool. No authentication is needed. Result is denial of service for legitimate users. Apache credits Khalilov Moe (LeetProtect) and the ASF. Part of a 15-CVE October 2026 release, and sibling CVE-2026-111805 is a similar h2 worker-pool issue.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| Apache Traffic Server | vendor | >= 8.0.0, <= 8.1.11; >= 9.0.0, <= 9.2.15; >= 10.0.0, <= 10.1.4; 10.2.0 | 9.2.16, 10.1.5, 10.2.1 |
8.0.0-8.1.11, 9.0.0-9.2.15, 10.0.0-10.1.4 or 10.2.09.2.16, 10.1.5 or 10.2.1. 8.x has no fixed release, so move to 9.2.16 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-111808")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.