Live › vulnerability › CVE-2026-111814
Go to dashboardApache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session that was authenticated with one client certificate for a transaction meant to present a different certificate. An attacker can therefore reach upstream servers under another client's identity.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Apache Traffic Server | vendor | >= 9.0.0, <= 9.2.15; >= 10.0.0, <= 10.1.4; 10.2.0 | 9.2.16, 10.1.5, 10.2.1 |
9.0.0-9.2.15, 10.0.0-10.1.4 or 10.2.0 AND ATS makes TLS connections to origins that need client certificates (mTLS), with different certificates for different transactions or remaps9.2.16, 10.1.5 or 10.2.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-111814")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.