CVE-2026-111817: Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout
Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.dropchunkedtrailers) until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on by default in 10.x. In 8.1.11 and 9.2.x it is off by default, and those versions are affected only if it is enabled.
This issue affects Apache Traffic Server: 8.1.11, from 9.2.5 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.1.5 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.2.1 - Configuration
Disable chunked trailer dropping by setting proxy.config.http.drop_chunked_trailers to off, particularly when running an affected version.
Apache Traffic Server proxy.config.http.drop_chunked_trailers = off
Event History
Frequently Asked Questions
Which deployments are exposed by default?
Apache Traffic Server 10.x has chunked-trailer dropping enabled by default, so affected 10.x releases are exposed under their default configuration. In 8.1.11 and 9.2.x, the issue applies only when proxy.config.http.drop_chunked_trailers is enabled.
What must an attacker do to trigger the issue?
An attacker needs network access to send a chunked transfer through Traffic Server where trailers are removed. No privileges or user interaction are required; the stalled passthrough transfer persists until the connection times out.
Which versions should be upgraded?
The affected releases are 8.1.11, 9.2.5 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. Upgrade to 10.1.5 or 10.2.1, which fix the issue.
What can be done if an immediate upgrade is not possible?
For deployments where trailer dropping has been enabled, disabling proxy.config.http.drop_chunked_trailers avoids the affected condition. This setting is already off by default in 8.1.11 and 9.2.x.