CVE-2026-111808
Description
A flaw was found in Apache Traffic Server. A remote attacker can exploit this vulnerability by sending a malformed padded HTTP/2 DATA frame. This issue causes the exhaustion of the backend HTTP/1.1 origin server's worker pool, resulting in a Denial of Service (DoS).
Statement
A flaw was found in Apache Traffic Server. A remote attacker can send a malformed padded HTTP/2 DATA frame that causes Traffic Server to exhaust the worker pool of a backend HTTP/1.1 origin server, resulting in denial of service. This issue affects Apache Traffic Server 8.0.0–8.1.11, 9.0.0–9.2.15, 9.0.0–10.1.4, and 10.2.0; it is fixed in 9.2.16, 10.1.5, and 10.2.1. Red Hat does not ship Apache Traffic Server in supported products; the affected relationships are the Fedora and EPEL community streams, which ship trafficserver 10.2.0.
Mitigation
Upgrade Apache Traffic Server to 9.2.16, 10.1.5, or 10.2.1. As a workaround, disabling HTTP/2 on the proxy (proxy.config.http2.enabled) or restricting HTTP/2 client access reduces exposure to backend worker-pool exhaustion.
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Memory; Modify Memory; Varies by Context
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
