CVE-2026-111810: Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service
Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains.
This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.16 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.1.5 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.2.1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker only needs network access to send requests containing many internal @ headers. No authentication or user interaction is required.
Which deployments are affected?
Apache Traffic Server versions 9.2.15, 10.1.4, and 10.2.0 are affected. The supplied information does not identify any configuration prerequisite, so deployments running those versions should be treated as exposed.
What is the impact of successful exploitation?
Each stripped internal @ header produces an unthrottled diagnostic log entry, allowing a relatively small request to cause disproportionate log output. This can consume logging or storage resources and cause denial of service.
How can the issue be remediated?
Upgrade Apache Traffic Server to 9.2.16, 10.1.5, or 10.2.1, as applicable to the deployed release line.