CVE-2026-111805: Apache Traffic Server HTTP/2 DOS Vulnerability

CVE-2026-111805 Overview

CVE-2026-111805 is a resource exhaustion vulnerability [CWE-400] in Apache Traffic Server (ATS). Attackers can abuse a truncated HTTP/2 Content-Length value to exhaust the worker pool of an HTTP/1.1 origin server behind the proxy. The flaw affects ATS versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. Apache has released fixed versions 9.2.16, 10.1.5, and 10.2.1. The issue is remotely exploitable over the network without authentication or user interaction.

Critical Impact
Remote unauthenticated attackers can exhaust origin worker pools, degrading or halting backend HTTP/1.1 service availability.

Affected Products

Apache Traffic Server 8.0.0 through 8.1.11
Apache Traffic Server 9.0.0 through 9.2.15
Apache Traffic Server 10.0.0 through 10.1.4, and 10.2.0

Discovery Timeline

2026-10-21 - CVE-2026-111805 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-111805

Vulnerability Analysis

Apache Traffic Server acts as a reverse proxy that translates HTTP/2 client requests into HTTP/1.1 requests toward origin servers. The vulnerability arises when ATS receives an HTTP/2 request containing a truncated Content-Length header value. ATS forwards the malformed request to the HTTP/1.1 origin, where the mismatched content length causes the origin worker thread to wait for additional request bytes that never arrive. Each malicious request consumes a worker from the origin's connection pool. Attackers who issue many such requests exhaust available workers and prevent legitimate clients from being served.

Root Cause

The root cause is improper validation of HTTP/2 pseudo-header and header field values during the HTTP/2-to-HTTP/1.1 protocol translation. ATS accepts a truncated Content-Length value and emits it to the upstream origin without rejecting the request or normalizing the length. The resulting HTTP/1.1 request stalls the origin's receive loop, which maps to [CWE-400] Uncontrolled Resource Consumption.

Attack Vector

Exploitation requires only network reach to an ATS instance that proxies to an HTTP/1.1 origin. An unauthenticated attacker opens HTTP/2 connections to ATS and submits crafted requests with truncated Content-Length values. ATS translates and forwards each request, pinning an origin worker in a blocked state. Repeated submission exhausts the origin's worker pool. The outcome is a denial of service against the origin, matching the CVSS 4.0 subsequent-system availability impact (SA:H). No user interaction or privileges are needed. See the Apache Security Mailing List Thread for additional context.

Detection Methods for CVE-2026-111805

Indicators of Compromise

Spikes in long-lived or stalled HTTP/1.1 connections from ATS to origin servers with incomplete request bodies.
Rising origin worker-pool saturation metrics or thread-exhaustion errors coinciding with HTTP/2 traffic bursts to ATS.
HTTP/2 requests to ATS carrying malformed or short content-length header values.

Detection Strategies

Inspect ATS access and error logs for repeated HTTP/2 requests with abnormal Content-Length values or truncated request framing.
Correlate ATS upstream connection counts against origin worker utilization to identify asymmetric growth consistent with pool exhaustion.
Deploy protocol-aware intrusion detection signatures that flag HTTP/2 content-length values inconsistent with observed DATA frame bytes.

Monitoring Recommendations

Alert on origin HTTP/1.1 worker pool utilization exceeding sustained thresholds (for example, 80 percent) tied to ATS upstream connections.
Track per-source HTTP/2 request rates to ATS and alert on anomalous burst patterns from single clients or small IP ranges.
Monitor ATS proxy.process.http2.* and upstream connection metrics for sudden shifts in request-to-response ratios.

How to Mitigate CVE-2026-111805

Immediate Actions Required

Upgrade Apache Traffic Server to 9.2.16, 10.1.5, or 10.2.1 as recommended by the Apache Traffic Server project.
Inventory all ATS deployments and identify instances fronting HTTP/1.1 origins, which are the primary exploitation targets.
Apply upstream rate limiting and connection ceilings between ATS and origin servers to contain exhaustion attempts until patching completes.

Patch Information

The Apache Traffic Server project has released versions 9.2.16, 10.1.5, and 10.2.1 that fix CVE-2026-111805. Users running any version in the 8.x branch should migrate to a supported fixed release, because no fixed 8.x version is listed in the advisory. Refer to the Apache Security Mailing List Thread for release details.

Workarounds

Restrict HTTP/2 ingress to ATS from untrusted networks where feasible, pending patch deployment.
Enforce strict request validation at an upstream web application firewall to reject HTTP/2 requests with inconsistent Content-Length headers.
Configure conservative origin worker and connection timeouts so that stalled HTTP/1.1 requests are terminated quickly and workers are freed.

bash

# Configuration example
# Verify installed Apache Traffic Server version and upgrade
traffic_server -V

# After upgrading, confirm the fixed version is active
# Expected: 9.2.16, 10.1.5, or 10.2.1