CVE-2026-111808: Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.16 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.1.5 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.2.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Apache Traffic Server in the affected version ranges are exposed when Traffic Server is used with an HTTP/1.1 origin. The issue can exhaust the origin's worker pool.
What does an attacker need to exploit it?
An attacker can trigger the issue remotely by sending a malformed padded HTTP/2 DATA frame. The supplied severity vector indicates no privileges or user interaction are required.
Which versions should be used to remediate the issue?
Upgrade to Apache Traffic Server 9.2.16, 10.1.5, or 10.2.1. These versions are identified as fixing the issue.