Live › vulnerability › CVE-2026-112381
Go to dashboardApache Traffic Server can crash with a null pointer dereference when a client POST request is half-closed while a chunked origin response is being reparsed. The sources do not say that an attacker gets code execution; the stated impact is a crash of the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Apache Traffic Server as a reverse or forward proxy on the affected versions, where clients send POST requests to origins that return chunked responses. Sources do not say which configurations trigger the race, so treat any proxy on an affected version as in scope. Deployments on versions outside the listed releases are not affected.
No product ranges from the sources yet.
traffic_server --version or traffic_server -V on each proxy host and compare against the affected versions 9.2.15, 10.1.4, 10.2.09.2.1610.1.510.2.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports.
This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-112381")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.