CVE-2026-111814: Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin
Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.16 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.1.5 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.2.1
Event History
Frequently Asked Questions
Which deployments are exposed by the default configuration?
Deployments running Apache Traffic Server versions 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, or 10.2.0 are affected because the default outbound session-sharing policy omits MASK_CERT. Exposure concerns pooled outbound TLS sessions where transactions are configured to use different client certificates.
What must occur for the issue to be triggered?
Apache Traffic Server must reuse a pooled TLS session that was authenticated with one client certificate for a transaction configured to present a different client certificate. The result is mTLS identity confusion at the origin.
What versions contain the fix?
Upgrade to Apache Traffic Server 9.2.16, 10.1.5, or 10.2.1. These versions fix the session-sharing policy issue.