← CVE index
Vulnerability record/PUBLISHED/Published Oct 21, 2026 19:10:46 UTC

CVE-2026-111805

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

Base score7.7/ 10
SeverityHighCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes
Base severityHigh
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsNoneAT
Privileges requiredNonePR
User interactionNoneUI
Vulnerable system confidentialityNoneVC
Vulnerable system integrityNoneVI
Vulnerable system availabilityNoneVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityHighSA
CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authorityapache
Last updatedOct 23, 2026 21:22:42 UTC
PublishedOct 21, 2026 19:10:46 UTC
ReservedOct 16, 2026 20:16:14 UTC

Credits

  • matrix_cain (YakLang)
  • Alieldeen Khaled Ali
  • Jesse Yang
  • Alex Williams (Pellera Technologies)
  • VulnCheck
  • The ASF