Apache Traffic Server: Null pointer dereference on POST half-close with chunked response
Summary
Apache Traffic Server versions 9.2.15, 10.1.4 and 10.2.0 can crash due to a null pointer dereference. The crash occurs when a client's POST request is half-closed while a chunked origin response is being re-parsed, a timing-dependent race introduced by earlier flow-control backports. An unauthenticated remote attacker can cause a denial of service, but the CVSS vector shows no impact on confidentiality or integrity. Only network-reachable ATS instances are exposed.
Affected
- Apache Traffic Server 9.2.15
- Apache Traffic Server 10.1.4
- Apache Traffic Server 10.2.0
- Earlier releases: Unverified. Check the ASF advisory directly.
Fixed in
- Apache Traffic Server 9.2.16
- Apache Traffic Server 10.1.5
- Apache Traffic Server 10.2.1
- Note: 9.2.16 does not fix CVE-2026-111817 (chunked-trailer stall), which is fixed only in 10.1.5 and 10.2.1.
Workaround
Unknown. No workaround found in the sources. Upgrading is the documented remedy.
Exploitation
- CISA SSVC: exploitation none, not automatable.
- Not listed in CISA KEV according to the available sources.
- No public proof of concept found.
- Point-in-time finding; recheck before relying on it.
Our recommendation
- Check whether any Apache Traffic Server instances exist in your environment.
- Upgrade internet-facing instances to 9.2.16, 10.1.5 or 10.2.1 within the normal patch cycle.
- Where 10.x is used, choose the same release to also fix CVE-2026-111817.
- Prioritise internet-facing instances; internal-only instances can be scheduled later.
- Monitor for repeated crashes or restarts of the ATS service.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- ASF October 2026 security advisory trafficserver.apache.org
- ASF mailing list announcement lists.apache.org
- Ubuntu security tracker ubuntu.com
- Vulners CVE record vulners.com
- Rescana release coverage www.rescana.com
- SecurityOnline release coverage securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:15.
Original description (NVD)
Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports. This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.