CVE-2026-111816 in Traffic Server
Summary
by MITRE • 10/21/2026
Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-framing desync.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability in Apache Traffic Server stems from a critical logic error within the HTTP response parsing mechanism, specifically concerning how chunked transfer encoding is handled during status code validation. When an upstream server sends a malformed HTTP/1.1 response containing a 302 Found status code alongside Transfer-Encoding: chunked headers, the proxy fails to reject it as a parse error. According to RFC 7230 and standard HTTP semantics, responses with certain status codes like 3xx redirects should not contain message bodies or specific transfer encodings that imply body content in this context. However, due to a code path oversight, the chunked carve-out logic bypasses the strict rejection checks designed to enforce protocol compliance. This allows the malformed response to be accepted and processed by the proxy rather than being discarded as invalid input from an upstream peer.
This parsing failure leads directly to a state desynchronization between Apache Traffic Server and its downstream clients or intermediate proxies. Because the server accepts a response that violates standard framing rules, it may store this inconsistent data in its cache. When subsequent requests are served from this cached entry, different peers interpreting the HTTP stream can read divergent message boundaries. This discrepancy creates an opportunity for HTTP Request Smuggling-like attacks, specifically manifesting as Cache Poisoning and Response-Framing Desynchronization. An attacker who controls or influences the upstream response content can exploit this inconsistency to inject malicious payloads into the cache, effectively poisoning it with unauthorized data that will be served to legitimate users.
The operational impact of this vulnerability is severe for any deployment relying on Apache Traffic Server as a reverse proxy or caching layer. Successful exploitation allows an adversary to bypass security controls such as Content Security Policies by injecting scripts or other executable content through poisoned cached responses. Furthermore, the desynchronization aspect can lead to request smuggling scenarios where requests are misrouted or duplicated, potentially exposing sensitive backend data or facilitating further attacks against internal services. The vulnerability affects multiple major versions of Apache Traffic Server, including 8.x up to 8.1.11, 9.x up to 9.2.15, and 10.x up to 10.1.4 as well as version 10.2.0, indicating a widespread exposure across recent releases that have not yet incorporated the corrective logic updates.
To mitigate this risk, organizations must upgrade Apache Traffic Server to patched versions immediately. The recommended upgrades are version 9.2.16 for the 9.x branch and version 10.1.5 or 10.2.1 for the newer branches. These releases contain the necessary fixes to ensure that malformed responses with conflicting headers like Transfer-Encoding: chunked on redirect status codes are correctly rejected at parse time, preventing them from entering the cache or being forwarded in a way that causes desynchronization. Until upgrades are applied, administrators should consider implementing strict upstream response validation via WAF rules if possible, though this is not a substitute for patching the core software flaw. This issue aligns with CWE-20 Improper Input Validation and falls under ATT&CK techniques related to Cache Poisoning and HTTP Request Smuggling, highlighting the importance of rigorous input sanitization in reverse proxy architectures.