CVE-2026-111808: Apache Traffic Server DOS Vulnerability

CVE-2026-111808 Overview

Apache Traffic Server contains a denial of service vulnerability that allows remote attackers to exhaust an HTTP/1.1 origin's worker pool. The flaw stems from improper handling of malformed padded HTTP/2 DATA frames. An attacker can send specially crafted frames through the proxy, causing resource exhaustion on backend origin servers.

The vulnerability affects Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. The Apache Software Foundation has released patched versions 9.2.16, 10.1.5, and 10.2.1 to address this issue. The weakness is classified as an integer underflow [CWE-191].

Critical Impact
Remote unauthenticated attackers can exhaust backend origin server worker pools, causing denial of service for all HTTP/1.1 origins behind the proxy.

Affected Products

Apache Traffic Server 8.0.0 through 8.1.11
Apache Traffic Server 9.0.0 through 9.2.15
Apache Traffic Server 10.0.0 through 10.1.4 and 10.2.0

Discovery Timeline

2026-10-21 - CVE CVE-2026-111808 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-111808

Vulnerability Analysis

Apache Traffic Server acts as a caching proxy that translates HTTP/2 client traffic to HTTP/1.1 when communicating with origin servers. The vulnerability occurs during the parsing of padded HTTP/2 DATA frames. When a malformed padded frame is received, improper length arithmetic triggers an integer underflow [CWE-191] in the data-handling path.

The downstream effect is that the proxy forwards or holds connections to the HTTP/1.1 origin in a way that consumes worker threads. Repeated malformed frames exhaust the origin's worker pool. Legitimate client requests then fail to receive responses, resulting in a denial of service condition affecting all traffic routed through the proxy.

Root Cause

The root cause is an integer underflow in the HTTP/2 DATA frame padding length calculation. HTTP/2 DATA frames may include a padding octet followed by variable-length padding. When the declared pad length exceeds the frame payload size, length subtraction wraps around, producing an incorrect data length value.

Attack Vector

The attack requires only network access to the proxy. No authentication or user interaction is required. An attacker opens an HTTP/2 connection to Apache Traffic Server and transmits malformed padded DATA frames. The proxy relays these to the HTTP/1.1 backend, where each malformed request consumes a worker until the pool is depleted.

The vulnerability is described in the Apache Mailing List Thread. No public proof-of-concept exploit is currently available.

Detection Methods for CVE-2026-111808

Indicators of Compromise

Unusual spikes in HTTP/2 DATA frames with the PADDED flag set from a single client or small source address range.
Rapid growth of pending requests or stalled worker threads on HTTP/1.1 origin servers behind Apache Traffic Server.
Elevated 5xx errors or request timeouts at origins while the proxy itself remains reachable.
Apache Traffic Server logs showing malformed HTTP/2 frame parsing warnings or truncated DATA frames.

Detection Strategies

Enable verbose HTTP/2 protocol logging on Apache Traffic Server to capture padded DATA frames with invalid pad lengths.
Deploy a web application firewall or reverse proxy upstream that validates HTTP/2 frame structure before traffic reaches Apache Traffic Server.
Correlate per-client HTTP/2 session metrics with origin worker thread utilization to identify abusive sessions.

Monitoring Recommendations

Monitor origin server worker pool saturation and alert when thread utilization exceeds defined thresholds.
Track HTTP/2 connection and stream rates per source IP for sudden anomalies.
Instrument Apache Traffic Server metrics for parsing errors and connection resets between proxy and origin.

How to Mitigate CVE-2026-111808

Immediate Actions Required

Upgrade Apache Traffic Server to version 9.2.16, 10.1.5, or 10.2.1 as published by the Apache Software Foundation.
Inventory all Apache Traffic Server deployments and confirm installed versions against the affected ranges.
Apply rate limiting on HTTP/2 connections and streams from untrusted sources until patches are deployed.

Patch Information

The Apache Software Foundation addressed this issue in Apache Traffic Server 9.2.16, 10.1.5, and 10.2.1. Users running any version in the 8.x branch should migrate to a supported release, as the 8.x branch does not have a listed fix. Refer to the Apache Mailing List Thread for release details.

Workarounds

Disable HTTP/2 on Apache Traffic Server listeners that face untrusted networks if patching cannot occur immediately.
Restrict HTTP/2 client access to trusted networks using firewall or ACL controls at the network perimeter.
Place an upstream protocol-aware proxy that strictly validates HTTP/2 DATA frame padding before forwarding to Apache Traffic Server.

bash

# Example: disable HTTP/2 in records.config until patched
CONFIG proxy.config.http2.enabled INT 0