CVE-2026-111817
Description
A flaw was found in Apache Traffic Server. When configured to drop HTTP chunked trailers, the proxy incorrectly waits for data bytes that it has already discarded, stalling the transfer until the connection times out. A remote attacker can exploit this condition by sending chunked transfers, resulting in a Denial of Service (DoS) for affected connections.
Statement
Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on by default in 10.x; in 8.1.11 and 9.2.x it is off by default and those versions are affected only if it is enabled. Fix: upgrade to 10.1.5/10.2.1; 9.2.x users can disable drop_chunked_trailers.
Mitigation
Disable proxy.config.http.drop_chunked_trailers on 8.1.11/9.2.x (off by default there; affected only if enabled); on 10.x, where the setting is on by default, upgrade to the fixed versions 10.1.5/10.2.1.
Understanding the Weakness (CWE)
Integrity,Non-Repudiation,Access Control
Technical Impact: Unexpected State; Hide Activities; Bypass Protection Mechanism
An attacker could create HTTP messages to exploit a number of weaknesses including 1) the message can trick the web server to associate a URL with another URL's webpage and caching the contents of the webpage (web cache poisoning attack), 2) the message can be structured to bypass the firewall protection mechanisms and gain unauthorized access to a web application, and 3) the message can invoke a script or a page that returns client credentials (similar to a Cross Site Scripting attack).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
