CWE data temporarily unavailableCWE data is currently experiencing intermittent outages, which may cause incomplete section loading on CVE pages. We are actively working on a fix.

CVE-2026-111805

Description

A flaw was found in Apache Traffic Server. A remote attacker can exploit this vulnerability by sending an HTTP/2 request containing a truncated Content-Length header. This causes Apache Traffic Server to exhaust the worker connection pool of upstream HTTP/1.1 origin servers, resulting in a Denial of Service (DoS).

Statement

A remote unauthenticated client can send a truncated HTTP/2 Content-Length, causing Traffic Server to forward an incomplete body and hold HTTP/1.1 origin workers until timeout, exhausting the origin worker pool (availability impact only: C:N/I:N/A:H).

Mitigation

Upgrade to 9.2.16 / 10.1.5 / 10.2.1 per branch; interim mitigation is limiting HTTP/2 ingress exposure or origin timeouts.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.