Apache Traffic Server: Cache poisoning via malformed 302 response
Summary
A flaw in Apache Traffic Server allows a malformed HTTP 302 response to bypass parse-error rejection because of an exemption for Transfer-Encoding: chunked. The proxy then stores and serves the response, which two peers may interpret differently. An unauthenticated remote attacker can thereby poison the cache and desynchronise response framing, provided caching is enabled and cached responses reach other users.
Affected
- Apache Traffic Server 8.0.0 through 8.1.11
- Apache Traffic Server 9.0.0 through 9.2.15
- Apache Traffic Server 10.0.0 through 10.1.4
- Apache Traffic Server 10.2.0
Fixed in
- 9.2.16
- 10.1.5
- 10.2.1
Note: the 9.2.16 fix should be verified on Apache's advisory page, as one passage in a secondary source is ambiguous. Distribution package status: Unknown.
Workaround
Unknown. No workaround has been identified for this CVE; upgrading is the documented fix.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial
- Not listed in CISA KEV; EPSS below 1%
- No public proof of concept found; this does not rule out that one exists
Our recommendation
- Check whether Apache Traffic Server is in use, including within vendor or hosting products
- Upgrade to 9.2.16, 10.1.5 or 10.2.1 (or later) matching your release line
- Verify the installed version after the upgrade
- Restrict exposure of the proxy or cache where possible and monitor Apache's advisory and CISA KEV for updates
- Prioritise according to CVSS 4.0 score 9.2 (vendor/CNA rating; VulDB rates 7.3)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Traffic Server security advisory (October 2026) trafficserver.apache.org
- Apache mailing list advisory thread lists.apache.org
- OpenCVE record CVE-2026-111816 app.opencve.io
- Vulners NVD record CVE-2026-111816 vulners.com
- VulDB entry 424967 vuldb.com
- Rescana analysis of the October 2026 security release www.rescana.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:06.
Original description (NVD)
Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-framing desync. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.