CVE-2026-111816: Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out
Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-framing desync.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.16 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.1.5 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.2.1
Event History
Frequently Asked Questions
Which deployments are affected?
Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 are affected.
What does an attacker need to exploit this issue?
The issue is network-reachable and requires no privileges or user interaction. Exploitation involves a malformed 302 response using Transfer-Encoding: chunked that is interpreted differently by two peers.
What is the impact of successful exploitation?
A malformed response can be stored and subsequently served by the cache, enabling cache poisoning and response-framing desynchronization. The stated impact includes high integrity impact and low confidentiality impact.
What versions remediate the issue?
Upgrade to Apache Traffic Server 9.2.16, 10.1.5, or 10.2.1, as applicable to your release line. The affected 8.x range has no fixed version listed in the provided data.