CVE-2026-111805: Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.16 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.1.5 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.2.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using an affected Apache Traffic Server version with an HTTP/1.1 origin can be exposed. The described impact is exhaustion of the origin's worker pool through Apache Traffic Server.
What does an attacker need to exploit it?
An attacker can exploit the issue remotely by sending a truncated HTTP/2 Content-Length value. No privileges or user interaction are required.
Which versions should be used to remediate the issue?
Upgrade to Apache Traffic Server 9.2.16, 10.1.5, or 10.2.1. These versions fix the issue.