{"id":"CVE-2026-111808","kind":"vulnerability","aliases":["CVE-2026-111808"],"related":[],"title":"Apache Traffic Server: malformed HTTP/2 frame exhausts origin worker pool","description":"Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","summary":"A client can send a malformed padded HTTP/2 DATA frame to Apache Traffic Server. The padding underflows (CWE-191) and ATS allocates many backend worker threads on the HTTP/1.1 origin, exhausting its worker pool. No authentication is needed. Result is denial of service for legitimate users. Apache credits Khalilov Moe (LeetProtect) and the ASF. Part of a 15-CVE October 2026 release, and sibling CVE-2026-111805 is a similar h2 worker-pool issue.","severity":"high","cvss":8.6,"epss":0.00324,"exploited":false,"exploited_at":null,"products":[{"name":"Apache Traffic Server","fixed":["9.2.16","10.1.5","10.2.1"],"affected":">= 8.0.0, <= 8.1.11; >= 9.0.0, <= 9.2.15; >= 10.0.0, <= 10.1.4; 10.2.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apache-traffic-server","denial-of-service","http2","runtime","self-hosted"],"not_affected_if":["managed-hosting","unaffected-versions"],"how_to_check":"Run traffic_server -V to get the version. You are affected on 8.0.0-8.1.11, 9.0.0-9.2.15, 10.0.0-10.1.4 or 10.2.0. Then see whether ATS accepts HTTP/2 from clients: look for h2 in the ALPN setting (proxy.config.ssl.client.alpn / records.yaml) and a TLS listener on your server ports. If clients can only use HTTP/1.1 the vendor does not say whether you are exposed (unconfirmed).","fix":"Upgrade to 9.2.16, 10.1.5 or 10.2.1. 8.x has no fixed release, so move to 9.2.16 or later. The advisory lists no config workaround.","status":"open","published_at":"2026-10-21T20:17:22+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:39:20+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T22:39:20Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Apache Traffic Server to 9.2.16, 10.1.5, or 10.2.1 (affected: 8.0.0-8.1.11, 9.0.0-9.2.15, 10.0.0-10.1.4, 10.2.0).","reach":"internet","title":"Apache Traffic Server: malformed HTTP/2 frame exhausts origin worker pool","impact":"medium","summary":"A malformed padded HTTP/2 DATA frame sent to Apache Traffic Server can make it exhaust the worker pool of an HTTP/1.1 origin server behind it. The result is a denial of service against the backend.","category":"runtime","who_cares":["apache-traffic-server","http2","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Backend origin server runs out of workers and stops serving requests","analyst_note":"Check NVD and the Apache Traffic Server security advisory for whether HTTP/2 must be enabled on the client side and for any config workaround.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unaffected-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000514,"input_tokens":2994,"output_tokens":429,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check NVD and the Apache Traffic Server security advisory for whether HTTP/2 must be enabled on the client side and for any config workaround.","search":"'-111805':99B '-111808':13A,16A '-191':51B '-2026':12A,15A,98B '10.0.0':144C '10.1.4':146C '10.1.5':156C '10.2.0':147C '10.2.1':158C '15':90B '2026':93B '8.0.0':136C '8.1.11':138C '9.0.0':140C '9.2.15':142C '9.2.16':155C 'affect':131C 'alloc':54B 'apach':1A,21B,44B,79B,108C,132C 'apache':17A 'apache-traffic-serv':20B 'asf':86B 'at':53B 'authent':68B 'backend':56B 'client':34B 'credit':80B 'cve':11A,14A,91B,97B 'cwe':50B 'data':41B,127C 'denial':25B,73B 'denial-of-servic':24B 'exhaust':7A,63B,115C 'fix':160C 'frame':6A,42B,128C 'h2':103B 'host':32B 'http/1.1':61B,117C 'http/2':5A,40B,126C 'http2':28B 'issu':107B,130C,162C 'khalilov':81B 'leetprotect':83B 'legitim':77B 'malform':4A,38B,124C 'mani':55B 'moe':82B 'need':70B 'octob':92B 'origin':8A,62B,118C 'pad':39B,48B,125C 'part':87B 'pool':10A,66B,106B,121C 'recommend':150C 'releas':94B 'result':71B 'runtim':29B 'self':31B 'self-host':30B 'send':36B 'server':3A,19A,23B,46B,110C,134C 'servic':27B,75B 'sibl':96B 'similar':102B 'thread':58B 'traffic':2A,18A,22B,45B,109C,133C 'underflow':49B 'upgrad':152C 'use':113C 'user':78B,148C 'version':154C 'via':122C 'worker':9A,57B,65B,105B,120C 'worker-pool':104B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T20:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111808","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111808","severity":null,"published_at":"2026-10-21T20:17:22+00:00","modified_at":"2026-10-23T22:16:55+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111808:517","url":null,"severity":null,"published_at":"2026-10-23T23:47:31+00:00","modified_at":"2026-10-23T23:47:31+00:00","first_seen_at":"2026-10-23T23:47:31+00:00","fetched_at":"2026-10-23T23:47:31+00:00","note":"Read ATS Oct 2026 advisory and CVE record: CWE-191 padding underflow in HTTP/2 DATA frame, unauthenticated, network; CVSS 8.6 (3.1). Vendor page gives no workaround and no explicit statement that HTTP/2 must be on, but the trigger is an HTTP/2 frame so clients reaching ATS over h2 are the exposure. No public PoC or exploitation found; social search not done."},{"source":"epss","external_id":"CVE-2026-111808","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111808","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":1624,"url":"https://trafficserver.apache.org/security-2026-10.html","title":"Apache Traffic Server October 2026 CVE Release","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2169,"url":"https://www.cve.org/CVERecord?id=CVE-2026-111808","title":"CVE Record: CVE-2026-111808","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}