CVE-2026-111815: Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement
Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verifyclient STRICT policy.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.16 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.1.5 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.2.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running affected Apache Traffic Server versions are exposed where TLS session resumption can occur across SNI virtual hosts and a resumed host relies on verify_client STRICT to require client-certificate verification.
What does an attacker need to exploit it?
An attacker needs to resume a TLS session across SNI virtual hosts. The vulnerable behavior allows the resumed host's verify_client STRICT client-certificate check to be bypassed during resumption.
Which versions fix the issue?
Upgrade to Apache Traffic Server 9.2.16, 10.1.5, or 10.2.1. Affected releases are 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0.