Vulnerability in Apache Software Foundation Apache Traffic Server

[ Description ]Official description

Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund21 Oct 2026WID-SEC-2026-4112

  Apache Traffic Server: Multiple vulnerabilities Translated from German

  Risk highCVE-2026-111814CVE-2026-111809CVE-2026-112381+12 more CVEs

[ References ]References

• lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc