CVE-2026-111817 in Traffic Server
Summary
by MITRE • 10/21/2026
Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on by default in 10.x. In 8.1.11 and 9.2.x it is off by default, and those versions are affected only if it is enabled.
This issue affects Apache Traffic Server: 8.1.11, from 9.2.5 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
Apache Traffic Server versions including 8.1.11 through specific releases in the 9.x and 10.x branches contain a logic error related to the handling of HTTP chunked transfer encoding trailers when the configuration directive drop_chunked_trailers is enabled. This vulnerability manifests as a denial-of-service condition where the proxy stalls an active connection indefinitely, waiting for trailer bytes that have already been discarded from memory or buffer structures. The root cause lies in a desynchronization between the protocol state machine and the actual data consumption logic; specifically, while the server strips the trailers to comply with configuration settings, it fails to properly update its internal expectations regarding remaining byte counts or stream termination signals. Consequently, the connection handler continues to wait for input that will never arrive because those bytes were removed prior to being processed by the downstream consumer or final response generator.
The operational impact of this flaw is significant for high-throughput proxy environments where chunked encoding is commonly used for dynamic content delivery. When a client sends a request with trailers and Apache Traffic Server is configured to drop them, the server enters an infinite wait state rather than cleanly closing the connection or signaling end-of-stream to the upstream origin or downstream client. This results in resource exhaustion as worker threads are held hostage by stalled connections, potentially leading to service degradation for other users sharing the same proxy instance. Since this behavior occurs during normal request processing involving chunked transfers with trailers, it can be triggered remotely without authentication if the target endpoint accepts such requests, making it a viable vector for remote denial-of-service attacks against infrastructure relying on Apache Traffic Server as a reverse or forward proxy.
From a standards perspective, this vulnerability aligns with CWE-400 Uncontrolled Resource Consumption and CWE-20 Improper Input Validation, as the system fails to correctly validate the completeness of the HTTP message body relative to its configured processing rules. In terms of adversarial tactics, this behavior corresponds to ATT&CK technique T1499 Endpoint Denial of Service, specifically through resource exhaustion via protocol-level manipulation. The flaw highlights a critical gap in state management where configuration-driven data modification leads to inconsistent internal state tracking, violating the principle that protocol parsers must maintain strict consistency between consumed bytes and expected stream boundaries regardless of post-processing transformations like trailer removal.
To mitigate this risk, organizations running affected versions should immediately upgrade Apache Traffic Server to version 10.1.5 or 10.2.1, where the logic error in chunked transfer handling has been corrected. For environments unable to patch immediately due to operational constraints, administrators can temporarily disable the drop_chunked_trailers configuration option by setting it to off, although this may result in increased memory usage and potential compliance issues with downstream systems that do not support HTTP trailers. Additionally, deploying a Web Application Firewall or rate-limiting rules at the network perimeter can help mitigate the impact of denial-of-service attempts by detecting and blocking connections that exhibit abnormal wait times or excessive resource consumption patterns associated with stalled chunked transfers.