Live › vulnerability › CVE-2026-111816
Go to dashboardApache Traffic Server accepts a malformed 302 response that uses chunked Transfer-Encoding when it should reject it. Peers can parse the same response differently, so an attacker can have a poisoned response stored in the cache and served to other users.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed version with traffic_server --version or the package manager; affected are 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0.
Upgrade to 9.2.16, 10.1.5, or 10.2.1, matching your release line.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-framing desync.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-111816")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.