CVE-2026-112381: Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response
Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports.
This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.16 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.1.5 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.2.1
Event History
Frequently Asked Questions
Who can trigger the crash, and what conditions are required?
An unauthenticated network client can trigger it, but exploitation requires a timing-dependent race: the client must half-close a POST request while Apache Traffic Server is reparsing a chunked response from the origin during a reentrant write-ready callback.
Which versions should be remediated?
Apache Traffic Server versions 9.2.15, 10.1.4, and 10.2.0 are affected. Upgrade to 9.2.16, 10.1.5, or 10.2.1, respectively.
What is the impact of successful exploitation?
Successful exploitation causes Apache Traffic Server to crash due to a null pointer dereference, resulting in denial of service. The provided severity vector indicates no confidentiality or integrity impact.