CVE-2026-111805 in Traffic Server
Summary
by MITRE • 10/21/2026
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
Apache Traffic Server is a high-performance web proxy and caching server widely deployed in enterprise environments to manage traffic flow between clients and origin servers. The vulnerability described involves a specific flaw in how the application handles HTTP/2 requests that are translated or proxied using HTTP/1.1 protocols when communicating with backend origins. Specifically, the issue arises from an incorrect parsing logic regarding the Content-Length header field within truncated HTTP/2 frames. When Apache Traffic Server processes these malformed headers, it fails to correctly calculate the body size required for the subsequent request sent to the origin server over HTTP/1.1. This miscalculation leads to a state where the connection with the origin remains open or is repeatedly attempted without proper closure, effectively tying up resources on both the proxy and the backend service.
The technical root cause lies in the boundary handling of HTTP/2 frame boundaries during protocol translation. In an ideal scenario, the reverse proxy should accurately map the chunked or framed data from HTTP/2 into a complete Content-Length header for the upstream HTTP/1.1 connection. However, due to this vulnerability, truncated values result in incomplete body transmission logic. This causes the origin server's worker pool threads to remain occupied waiting for additional data that will never arrive according to the flawed length specification. Over time, as more such requests are processed, the finite number of available worker threads on the origin server becomes exhausted. Once all workers are tied up with these stalled connections, legitimate traffic is denied service because there are no free resources to handle new incoming requests.
From an operational perspective, this vulnerability facilitates a Denial of Service attack against backend infrastructure rather than directly crashing the Apache Traffic Server itself. An attacker can exploit this by sending carefully crafted HTTP/2 requests containing truncated Content-Length values. The impact is severe for organizations relying on limited-origin architectures or those with strict concurrency limits on their backend applications. As the origin server's capacity to process new connections drops to zero, users experience timeouts and service unavailability. This type of resource exhaustion attack undermines the availability pillar of the CIA triad, disrupting business operations that depend on real-time data access through the proxy layer.
This flaw aligns with CWE-20 Improper Input Validation, as the system fails to properly validate or correctly interpret the length attribute in a truncated context. Furthermore, it maps to MITRE ATT&CK technique T1498 Network Denial of Service, specifically sub-category Direct Network Flood if viewed through resource exhaustion lenses, although more accurately it represents an application-layer denial of service via protocol abuse. The exploitation does not require authentication and can be performed remotely by any client capable of sending HTTP/2 traffic to the proxy.
To mitigate this risk, organizations must upgrade Apache Traffic Server immediately to version 9.2.16, 10.1.5, or 10.2.1, as these releases contain patches that correct the parsing logic for Content-Length headers during protocol translation. Until an upgrade is feasible, administrators should consider implementing rate limiting on incoming HTTP/2 connections and deploying Web Application Firewalls configured to detect anomalous header patterns indicative of this truncation attack. Additionally, monitoring origin server worker pool utilization metrics can provide early warning signs of such resource exhaustion attacks, allowing for rapid incident response before total service outage occurs.