CVE-2026-111816
Description
A flaw was found in Apache Traffic Server. Malformed HTTP 302 redirect responses containing chunked transfer encoding are improperly forwarded instead of being rejected as parse errors. A remote attacker can exploit this condition to cause HTTP response desynchronization and cache poisoning, potentially resulting in data tampering or unauthorized content delivery to other users.
Statement
This vulnerability is rated as Important severity because successful exploitation allows upstream servers or remote attackers to induce HTTP response desynchronization and poison shared proxy caches without authentication. When Apache Traffic Server is deployed as a reverse proxy or caching intermediary, parsing inconsistencies in malformed redirect responses allow attacker-controlled content to be cached and served to subsequent clients. The risk is particularly pronounced in proxy environments that process traffic across trust boundaries.
Understanding the Weakness (CWE)
Integrity,Non-Repudiation,Access Control
Technical Impact: Unexpected State; Hide Activities; Bypass Protection Mechanism
An attacker could create HTTP messages to exploit a number of weaknesses including 1) the message can trick the web server to associate a URL with another URL's webpage and caching the contents of the webpage (web cache poisoning attack), 2) the message can be structured to bypass the firewall protection mechanisms and gain unauthorized access to a web application, and 3) the message can invoke a script or a page that returns client credentials (similar to a Cross Site Scripting attack).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
