CVE-2026-111816

Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out

Assigner: apache
Reserved: 16.10.2026 Published: 21.10.2026 Updated: 21.10.2026

Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-framing desync.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.

Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
CVSS Score: 9.3

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	None

CVSS 3.1

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N
CVSS Score: 9.2

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	None	Confidentiality	Low
Attack Complexity	Low	Integrity	High	Integrity	High
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	Apache Software Foundation
Product	Apache Traffic Server
Versions	Default: unaffected affected from 8.0.0 to 8.1.11 (incl.) affected from 9.0.0 to 9.2.15 (incl.) affected from 10.0.0 to 10.1.4 (incl.) Version 10.2.0 is affected

Vendor

Apache Software Foundation

Product

Apache Traffic Server

Versions

Default: unaffected

affected from 8.0.0 to 8.1.11 (incl.)
affected from 9.0.0 to 9.2.15 (incl.)
affected from 10.0.0 to 10.1.4 (incl.)
Version 10.2.0 is affected

Credits

Apache Community reporter
OneZ3r0 reporter

References

Problem Types