CVE-2026-65324: Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion
Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.15 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65324?
CVE-2026-65324 has a severity rating of high with a score of 7.5.
How do I fix CVE-2026-65324?
To mitigate CVE-2026-65324, upgrade Apache Traffic Server to versions 8.1.10, 9.2.15, or 10.1.4 or later.
What can be exploited in CVE-2026-65324?
CVE-2026-65324 allows slow clients to exploit the buffer cap removal during dechunking, potentially leading to memory exhaustion on the server.
Which versions of Apache Traffic Server are affected by CVE-2026-65324?
CVE-2026-65324 affects Apache Traffic Server versions from 8.0.0 to 8.1.9, 9.0.0 to 9.2.14, and 10.0.0 to 10.1.3.
What are the potential impacts of CVE-2026-65324?
The primary impact of CVE-2026-65324 is server instability due to memory exhaustion caused by a dechunking vulnerability.