Key points
- CVE-2026-111805 is rated high severity with a CVSS score of 8.6.
- The flaw affects Apache Traffic Server versions 8.0.0 through 10.2.0.
- Fixes are available in versions 9.2.16, 10.1.5, and 10.2.1.
Apache Traffic Server administrators can now apply patches for a high-severity vulnerability identified as CVE-2026-111805. The issue affects multiple major release lines, including versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, and 10.0.0 through 10.2.0. The Apache Software Foundation has released updated builds for specific branches that resolve the problem.
In plain English
The vulnerability allows an attacker to exhaust the worker pool of an HTTP/1.1 origin server. This is achieved by sending a truncated HTTP/2 Content-Length value through the proxy. When the worker pool is exhausted, the server may become unable to process further requests, leading to service disruption for legitimate users.
The background
The National Vulnerability Database lists CVE-2026-111805 with a CVSS score of 8.6, which falls into the high severity range. The underlying weakness is categorized under CWE-400, which relates to resource exhaustion. The flaw exists in how Apache Traffic Server handles specific HTTP/2 protocol details when communicating with upstream HTTP/1.1 servers.
What changes now
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1 to fix the issue. These specific builds address the truncated Content-Length handling. Organizations running affected versions should verify their current software release against the list of vulnerable versions provided by the vendor.
Who needs to act first
Teams usually prioritize systems that face direct internet traffic or handle high volumes of external requests. Check whether your deployment uses HTTP/2 to backend HTTP/1.1 services, as this configuration is directly relevant. Roll out updates to a small test group first to ensure stability. Back up current configurations before applying changes. Monitor server logs for unusual resource spikes during the transition period.
What to do and how to stay safe: Apache Traffic Server
- Inventory all servers running Apache Traffic Server to identify if they fall within the affected version ranges.
- Download and test the patched versions (9.2.16, 10.1.5, or 10.2.1) in a non-production environment before widespread deployment.
- Monitor system resources, specifically worker pool usage, for signs of exhaustion or unusual HTTP/2 traffic patterns.
- Review network logs for any suspicious truncated Content-Length headers that may indicate attempted exploitation.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Apache Traffic Server versions are vulnerable to CVE-2026-111805?
Versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 are affected.
Is there a fix available for this vulnerability?
Yes, users should upgrade to version 9.2.16, 10.1.5, or 10.2.1 to resolve the issue.
What is the severity rating of CVE-2026-111805?
The vulnerability has a CVSS score of 8.6, which is rated as high severity.
