CVE-2026-111809
Description
A flaw was found in Apache Traffic Server. An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted HEAD requests containing Content-Length or Transfer-Encoding headers. This flaw enables HTTP request smuggling, where intermediate proxies and backend servers disagree on request boundaries. Successful exploitation may allow an attacker to bypass security boundaries, poison web caches, or hijack user requests.
Statement
This vulnerability is rated as having Moderate impact because successful HTTP request smuggling requires a specific multi-tier proxy architecture where upstream and downstream systems handle ambiguous message framing differently. Apache Traffic Server is not included or supported in Red Hat Enterprise Linux or other core Red Hat product offerings. Consequently, default Red Hat environments are unaffected unless unsupported standalone instances of the caching proxy are deployed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
