{"id":"CVE-2026-112381","kind":"vulnerability","aliases":["CVE-2026-112381"],"related":[],"title":"Apache Traffic Server: half-closed POST request crashes the proxy via null pointer","description":"Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports.\n\n\n\nThis issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","summary":"Apache Traffic Server can crash with a null pointer dereference when a client POST request is half-closed while a chunked origin response is being reparsed. The sources do not say that an attacker gets code execution; the stated impact is a crash of the server.","severity":"high","cvss":8.2,"epss":0.00256,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-traffic-server","proxy","runtime","self-hosted"],"not_affected_if":["unaffected-version"],"how_to_check":"- Run `traffic_server --version` or `traffic_server -V` on each proxy host and compare against the affected versions `9.2.15`, `10.1.4`, `10.2.0`\n- Check whether the installed package is from the affected release line with your package manager's version query","fix":"- Upgrade Apache Traffic Server 9.2.x to `9.2.16`\n- Upgrade Apache Traffic Server 10.1.x to `10.1.5`\n- Upgrade Apache Traffic Server 10.2.x to `10.2.1`","status":"open","published_at":"2026-10-21T20:17:23+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:03:47+00:00","updated_at":"2026-10-25T03:03:47+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:03:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Traffic Server 9.2.x to `9.2.16`\n- Upgrade Apache Traffic Server 10.1.x to `10.1.5`\n- Upgrade Apache Traffic Server 10.2.x to `10.2.1`","reach":"internet","title":"Apache Traffic Server: half-closed POST request crashes the proxy via null pointer","impact":"low","summary":"Apache Traffic Server can crash with a null pointer dereference when a client POST request is half-closed while a chunked origin response is being reparsed. The sources do not say that an attacker gets code execution; the stated impact is a crash of the server.","category":"runtime","nicknames":[],"who_cares":["apache-traffic-server","self-hosted","proxy"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Proxy process crashes, causing service disruption for traffic it serves","analyst_note":"Confirm from the Apache Traffic Server security advisory whether the crash is the only impact and whether any non-default configuration is required; sources only give the NVD record and EPSS.","how_to_check":"- Run `traffic_server --version` or `traffic_server -V` on each proxy host and compare against the affected versions `9.2.15`, `10.1.4`, `10.2.0`\n- Check whether the installed package is from the affected release line with your package manager's version query","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Teams running Apache Traffic Server as a reverse or forward proxy on the affected versions, where clients send POST requests to origins that return chunked responses. Sources do not say which configurations trigger the race, so treat any proxy on an affected version as in scope. Deployments on versions outside the listed releases are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000667,"input_tokens":3424,"output_tokens":650,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112381':17A,20A '-2021':123C '-2026':16A,19A '-32564':124C '10.1.4':136C '10.1.5':146C '10.2.0':137C '10.2.1':148C '9.2.15':135C '9.2.16':145C 'affect':131C 'apach':1A,22B,30B,77C,132C 'apache-traffic-serv':21B 'attack':64B 'backport':128C 'callback':113C 'chunk':51B,101C 'client':42B,89C 'close':6A,48B,98C 'code':66B 'control':127C 'crash':9A,34B,73B,81C 'cve':15A,18A,122C 'depend':117C 'derefer':39B,86C 'execut':67B 'fix':150C 'flow':126C 'flow-control':125C 'get':65B 'half':5A,47B,97C 'half-clos':4A,46B,96C 'host':29B 'impact':70B 'introduc':119C 'issu':130C,152C 'null':13A,37B,84C 'origin':52B,102C 'pointer':14A,38B,85C 'post':7A,43B,90C 'proxi':11A,25B 'race':118C 'readi':112C 'recommend':140C 'reentrant':109C 'repars':56B,106C 'request':8A,44B,91C 'respons':53B,103C 'runtim':26B 'say':61B 'self':28B 'self-host':27B 'server':3A,24B,32B,76B,79C,134C 'sourc':58B 'state':69B 'time':116C 'timing-depend':115C 'torn':93C 'traffic':2A,23B,31B,78C,133C 'upgrad':142C 'user':138C 'version':144C 'via':12A,95C 'write':111C 'write-readi':110C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Traffic Server as a reverse or forward proxy on the affected versions, where clients send POST requests to origins that return chunked responses. Sources do not say which configurations trigger the race, so treat any proxy on an affected version as in scope. Deployments on versions outside the listed releases are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T20:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112381","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112381","severity":null,"published_at":"2026-10-21T20:17:23+00:00","modified_at":"2026-10-23T22:16:56+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112381","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112381","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}