CVE-2026-111808 in Traffic Server
Summary
by MITRE • 10/22/2026
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/22/2026
Apache Traffic Server is a high-performance web proxy and caching server widely deployed in enterprise environments to manage traffic flow between clients and origin servers. The vulnerability described involves a specific flaw in how the application handles HTTP/2 protocol frames when communicating with upstream origins that are still operating on or supporting HTTP/1.1 protocols through translation layers or legacy configurations. Specifically, the issue arises from the processing of malformed padded HTTP/2 DATA frames sent by clients. When Apache Traffic Server receives such a frame, it fails to correctly validate or limit the padding length before forwarding the request to the origin server in an HTTP/1.1 format. This lack of proper input validation allows an attacker to craft requests with excessively large padding values that are technically valid under the loose interpretation of the protocol but result in disproportionately large payloads being sent to the backend service.
The operational impact of this vulnerability is a denial of service against the origin server rather than Apache Traffic Server itself, although it can indirectly affect system stability by consuming network bandwidth and proxy resources while waiting for responses from overwhelmed backends. By sending these malformed padded frames, an attacker can exhaust the worker pool or connection limits of the HTTP/1.1 origin server. Since many legacy systems have limited concurrency capabilities, flooding them with large requests derived from small client inputs via padding abuse causes resource exhaustion. This leads to service degradation for legitimate users as the origin server becomes unable to process new connections due to being saturated by these maliciously crafted traffic patterns. The attack vector is remote and requires only network access to send HTTP/2 requests through the proxy, making it a significant risk in public-facing deployments where attackers can interact directly with the edge infrastructure.
From a technical classification perspective, this vulnerability aligns with CWE-787 Out-of-bounds Write if interpreted as memory corruption during parsing, but more accurately fits CWE-400 Uncontrolled Resource Consumption because the primary consequence is resource exhaustion on the backend. In terms of attack tactics, it maps to MITRE ATT&CK technique T1499 Endpoint Denial of Service, specifically under sub-techniques involving application layer flooding or protocol abuse. The flaw highlights a critical gap in boundary checking during protocol translation between HTTP/2 and HTTP/1.1, where the proxy acts as an intermediary that must normalize frame structures before forwarding them to upstream services. Without strict enforcement of padding limits relative to expected payload sizes, the system becomes susceptible to amplification-style attacks against downstream components.
To mitigate this risk, organizations running affected versions of Apache Traffic Server should immediately upgrade to version 9.2.16, 10.1.5, or 10.2.1 as recommended by the vendor. These releases include patches that enforce stricter validation on HTTP/2 frame padding lengths before translation and forwarding occurs. In addition to upgrading, administrators can implement temporary mitigations such as configuring rate limiting rules at the proxy level to restrict the size of incoming requests or disabling support for padded DATA frames if they are not required by their specific application stack. Monitoring logs for unusually large request sizes originating from single clients can also help in detecting ongoing exploitation attempts while patching is being applied. Ensuring that upstream origin servers have robust connection limits and auto-scaling capabilities provides an additional layer of defense against such resource exhaustion attacks, reducing the blast radius if a vulnerability is exploited before full remediation is achieved across all proxy nodes.