Live › vulnerability › CVE-2026-111809
Go to dashboardApache Traffic Server mishandles HEAD requests that carry Content-Length or Transfer-Encoding headers, letting a remote attacker desynchronize request parsing. An attacker can smuggle requests through the proxy to reach back-end handling that should be blocked.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the running version, for example with traffic_server -V or the installed package version; affected are 8.0.0 to 8.1.11, 9.0.0 to 9.2.15, 10.0.0 to 10.1.4, and 10.2.0.
Upgrade to 9.2.16, 10.1.5, or 10.2.1, matching your major line.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-111809")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.