Live › vulnerability › CVE-2026-111815
Go to dashboardApache Traffic Server can resume a TLS session on a virtual host that requires client certificates without checking the certificate again. An attacker who holds a session from a permissive host may reach a strict mTLS host without presenting a valid client certificate.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
8.0.0-8.1.11, 9.0.0-9.2.15, 10.0.0-10.1.4 and 10.2.0Upgrade to 9.2.16, 10.1.5, or 10.2.1, matching your release line.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-111815")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.