CVE-2026-112381 in Traffic Server
Summary
by MITRE • 10/21/2026
Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports.
This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in Apache Traffic Server represents a critical stability flaw rooted in complex asynchronous I/O handling and race conditions within the server's flow control mechanisms. This specific defect manifests as a null pointer dereference that leads to an application crash or denial of service condition. The root cause is tied to the interaction between client-side request teardowns, specifically half-close scenarios during POST requests, and the internal reparsing logic for chunked responses originating from backend servers. When a connection is partially closed by the client while the server is actively processing data, it triggers a reentrant write-ready callback that attempts to reparse incoming chunks. Due to timing dependencies introduced by backported flow-control improvements associated with CVE-2021-32564, the internal state management fails to correctly handle this specific sequence of events, resulting in an attempt to dereference a null pointer within the response parsing logic.
From a technical perspective, Apache Traffic Server operates as a high-performance reverse proxy and caching HTTP server that relies heavily on non-blocking I/O models such as epoll or kqueue. In these environments, callbacks are frequently invoked when file descriptors become ready for reading or writing. The vulnerability arises because the flow-control backports intended to improve performance inadvertently created a race condition where the state of the connection object becomes inconsistent during rapid teardowns. When a client initiates a half-close while sending POST data, and simultaneously an origin server sends chunked responses that require reparsing due to buffer management decisions made in previous callbacks, the system enters a critical section without proper synchronization or null checks on intermediate pointers. This leads directly to a segmentation fault when the code attempts to access memory addresses associated with deallocated or uninitialized structures within the transaction context.
The operational impact of this vulnerability is primarily focused on service availability rather than data confidentiality or integrity. An attacker who can control network timing and send carefully crafted POST requests that trigger half-closes at precise moments during chunked response processing could cause the Apache Traffic Server process to crash repeatedly. This constitutes a denial-of-service attack vector, potentially disrupting traffic for all downstream clients relying on this proxy instance. Since the vulnerability is timing-dependent, it may be difficult to reproduce consistently in low-traffic environments but becomes highly exploitable under load or specific network latency conditions that align with the race window. The impact extends beyond simple downtime; frequent crashes can lead to loss of cached content and require manual intervention to restart services, increasing operational overhead for system administrators.
This issue is classified under CWE-476, which denotes a NULL Pointer Dereference vulnerability. In terms of attack patterns, it aligns with MITRE ATT&CK techniques related to Denial of Service via application crashes or resource exhaustion. The specific mechanism involves exploiting asynchronous event handling flaws within the web server's core engine. To mitigate this risk, organizations running affected versions must upgrade immediately to patched releases where these race conditions have been resolved through improved state management and additional null checks in the callback handlers. Specifically, users should migrate to Apache Traffic Server version 9.2.16 for the 9.x branch, version 10.1.5 for the 10.1 branch, or version 10.2.1 for the latest stable release. Until upgrades are performed, administrators may consider implementing rate limiting on POST requests from untrusted sources and monitoring server logs for frequent process restarts as an indicator of potential exploitation attempts.