CVE-2026-112381
Description
A flaw was found in Apache Traffic Server. A race condition can allow an unauthenticated remote attacker to cause a Denial of Service (DoS) by crashing the server. This vulnerability occurs when a client terminates a POST request connection while the server is processing a chunked origin response, triggering a null pointer dereference.
Statement
Apache Traffic Server crashes with a null pointer dereference in net_write_io when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback; Red Hat does not ship trafficserver in any RH-scoped product — only Fedora/EPEL community streams, whose shipped versions (9.2.15, 10.2.0) are within the upstream affected range.
Mitigation
Upgrade to Apache Traffic Server 9.2.16 (9.x), 10.1.5 (10.1.x), or 10.2.1 (10.2.x) or later.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
