CVE-2026-111809: Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling
Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.16 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.1.5 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.2.1
Event History
Frequently Asked Questions
Which Apache Traffic Server deployments are affected?
Affected versions are 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. The fixed releases are 9.2.16, 10.1.5, and 10.2.1.
Does exploiting this issue require authentication or user interaction?
No. The supplied severity vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction.
What traffic pattern is relevant when assessing exposure?
The issue is triggered by HEAD requests that include a Content-Length or Transfer-Encoding header. Review whether untrusted clients can send such requests through Apache Traffic Server.