CVE-2026-111810: Apache Traffic Server DOS Vulnerability

CVE-2026-111810 Overview

CVE-2026-111810 is a resource exhaustion vulnerability in Apache Traffic Server (ATS) that enables log amplification denial of service. The proxy writes one unthrottled diagnostic log line for every internal @ header it strips from an incoming request. An attacker can send a single request carrying many internal @ headers to force the proxy to write disproportionately large volumes of log data. This amplifies disk I/O and storage consumption well beyond the size of the originating request. The flaw is tracked under [CWE-400: Uncontrolled Resource Consumption]. Affected versions include Apache Traffic Server 9.2.15, 10.1.4, and 10.2.0.

Critical Impact
Unauthenticated remote attackers can trigger disk and logging subsystem exhaustion on ATS proxies by sending crafted requests containing many internal @ headers.

Affected Products

Apache Traffic Server 9.2.15
Apache Traffic Server 10.1.4
Apache Traffic Server 10.2.0

Discovery Timeline

2026-10-21 - CVE-2026-111810 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-111810

Vulnerability Analysis

Apache Traffic Server treats HTTP headers prefixed with @ as internal headers that must be stripped from client-supplied requests before processing. For each stripped @ header, the proxy emits a diagnostic log line without any rate limiting or throttling. The ratio between request bytes and log bytes becomes attacker-controlled.

A single HTTP request a few kilobytes in size can carry hundreds or thousands of @-prefixed header fields. Each triggers an independent write to the diagnostic log pipeline. The resulting log output can exceed the request size by orders of magnitude. This behavior constitutes an amplification primitive against the proxy's logging subsystem, disk, and any downstream log aggregation infrastructure.

Root Cause

The root cause is missing throttling on the diagnostic logging path that handles internal @ header stripping. The code emits one log entry per stripped header without aggregation, suppression, or rate limiting. The design assumes @ headers are rare and unintentional rather than attacker-controlled input, violating the resource consumption guarantees expected from a reverse proxy under hostile traffic.

Attack Vector

The vulnerability is reachable over the network without authentication or user interaction. An attacker crafts an HTTP request containing a large number of header fields beginning with the @ character and sends it to any Apache Traffic Server instance running an affected version. Repeated requests can rapidly fill disk volumes, saturate log write throughput, or exhaust downstream log collectors. The attack requires no special privileges and leaves no distinctive payload beyond unusual header counts.

For technical specifics, refer to the Apache Mailing List Discussion.

Detection Methods for CVE-2026-111810

Indicators of Compromise

Rapid growth of ATS diagnostic log files disproportionate to request volume handled by the proxy.
Repeated diagnostic log entries indicating that internal @-prefixed headers were stripped from client requests.
Disk space alerts, log partition exhaustion, or logging-subsystem backpressure on hosts running affected ATS versions.

Detection Strategies

Inspect HTTP request streams for requests containing an abnormally high count of header fields beginning with @.
Monitor the ratio of inbound HTTP bytes to generated diagnostic log bytes on ATS instances for sudden amplification.
Correlate spikes in log write throughput with specific client source IPs to identify abusive request patterns.

Monitoring Recommendations

Alert on sustained increases in diags.log write rate on Apache Traffic Server hosts.
Track disk utilization on log volumes with thresholds that fire well before saturation.
Record and review Remote-IP, User-Agent, and header count metrics in access logs to attribute amplification events.

How to Mitigate CVE-2026-111810

Immediate Actions Required

Upgrade Apache Traffic Server to version 9.2.16, 10.1.5, or 10.2.1 depending on the deployed branch.
Audit disk capacity and log rotation policies on all ATS hosts to limit the blast radius of amplification.
Place a filtering layer in front of ATS to drop requests containing excessive header counts until patched.

Patch Information

The Apache Traffic Server project has released fixed versions 9.2.16, 10.1.5, and 10.2.1 that address the unthrottled logging behavior. Operators running 9.2.15, 10.1.4, or 10.2.0 should upgrade to the corresponding fixed release on their branch. Review the Apache Mailing List Discussion for release details.

Workarounds

Deploy an upstream reverse proxy or web application firewall that rejects or normalizes requests with more than a small number of @-prefixed headers.
Reduce ATS diagnostic log verbosity on affected versions to limit the per-header log volume until the patch is applied.
Aggressively rotate and compress ATS log files, and move log volumes to storage with hard quotas to contain amplification.

bash

# Configuration example
# Verify installed Apache Traffic Server version
traffic_server -V

# After upgrading, confirm the fixed version is in place
# Expected output: 9.2.16, 10.1.5, or 10.2.1