CVE-2026-111816: Apache Traffic Server Cache Poisoning DOS

CVE-2026-111816 Overview

CVE-2026-111816 is an HTTP request/response smuggling vulnerability in Apache Traffic Server (ATS). The proxy forwards a malformed 302 response that should have been rejected as a parse error. A carve-out for Transfer-Encoding: chunked bypasses the rejection path, allowing a response that two peers can parse differently to be stored and served. Attackers can leverage this parsing inconsistency to achieve cache poisoning and response-framing desynchronization. The flaw is classified under CWE-444: Inconsistent Interpretation of HTTP Requests.

Critical Impact
Attackers can poison the ATS cache with malformed 302 responses and desynchronize response framing, enabling downstream clients to receive attacker-controlled content from trusted origins.

Affected Products

Apache Traffic Server 8.0.0 through 8.1.11
Apache Traffic Server 9.0.0 through 9.2.15
Apache Traffic Server 10.0.0 through 10.1.4, and 10.2.0

Discovery Timeline

2026-10-21 - CVE-2026-111816 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-111816

Vulnerability Analysis

Apache Traffic Server acts as a caching HTTP proxy between clients and origin servers. The response parser contains validation logic that rejects malformed HTTP responses as parse errors. The parser also implements a special carve-out for responses that declare Transfer-Encoding: chunked, which skips certain structural checks on the response.

When a crafted 302 redirect response arrives containing Transfer-Encoding: chunked, the carve-out short-circuits the rejection path. ATS accepts and forwards the malformed message instead of discarding it. Downstream HTTP parsers interpret the same bytes differently from ATS, producing a desynchronization condition where two peers disagree on where one response ends and the next begins.

The practical consequences are HTTP response smuggling and cache poisoning. An attacker can store a malicious response under a legitimate cache key, which subsequent clients will then receive. The response-framing desync can also allow attacker-controlled content to be served in the context of a trusted origin.

Root Cause

The root cause is an improper interaction between the parse-error rejection path and the Transfer-Encoding: chunked handling branch. The chunked carve-out suppresses validation that would otherwise reject the malformed 302. This is a classic [CWE-444] inconsistent interpretation flaw where upstream and downstream parsers disagree.

Attack Vector

Exploitation requires a network-reachable Apache Traffic Server instance. An attacker needs the ability to influence an origin response or operate a malicious origin that ATS proxies. No authentication or user interaction is required. The malformed 302 with Transfer-Encoding: chunked is delivered through normal proxied traffic and relies on ATS forwarding the parser-divergent message. Technical details are documented in the Apache Mailing List Thread.

Detection Methods for CVE-2026-111816

Indicators of Compromise

Cached 302 responses with Transfer-Encoding: chunked headers where the chunked framing does not match the response body length.
Unexpected redirect targets served from cache for URLs that normally return non-redirect content.
Downstream clients reporting response bodies that appear misaligned with request order or contain fragments of adjacent responses.

Detection Strategies

Inspect ATS access and error logs for parse warnings associated with 302 responses carrying Transfer-Encoding: chunked.
Deploy an HTTP-aware intrusion detection signature that flags responses combining a 302 status with both Transfer-Encoding: chunked and Content-Length headers.
Correlate cache insertion events with origin responses that fail strict RFC 9112 message-framing validation.

Monitoring Recommendations

Monitor the ATS version string across all proxy nodes and alert on instances running 8.0.0–8.1.11, 9.0.0–9.2.15, 10.0.0–10.1.4, or 10.2.0.
Baseline normal rates of 302 responses per origin and alert on sudden deviations that may indicate smuggling attempts.
Enable response-header logging on ATS and ship logs to a centralized analytics platform for correlation against downstream server logs.

How to Mitigate CVE-2026-111816

Immediate Actions Required

Upgrade Apache Traffic Server to version 9.2.16, 10.1.5, or 10.2.1 as released by the Apache Software Foundation.
Audit all ATS deployments and inventory versions in the vulnerable ranges for prioritized patching.
Purge the ATS object cache after upgrading to evict any poisoned entries that may have been stored before remediation.

Patch Information

The Apache Traffic Server project has released fixed versions 9.2.16, 10.1.5, and 10.2.1. The 8.x branch is listed as affected (8.0.0 through 8.1.11) but no fixed 8.x release is identified in the advisory; operators on 8.x should migrate to a supported fixed branch. Refer to the Apache Mailing List Thread for the full advisory.

Workarounds

Place a strict HTTP-conformant reverse proxy or WAF in front of ATS to reject 302 responses that contain Transfer-Encoding: chunked with malformed framing.
Disable caching for origins that cannot be trusted to send conformant 302 responses until the upgrade is applied.
Restrict which origins ATS will proxy to reduce exposure to attacker-controlled responses.

bash

# Verify installed Apache Traffic Server version
traffic_server --version

# Example: upgrade on Debian/Ubuntu after adding fixed-version package
sudo apt-get update && sudo apt-get install --only-upgrade trafficserver

# Clear the ATS cache after upgrading to remove any poisoned entries
sudo traffic_ctl server stop
sudo traffic_server -Cclear_cache
sudo traffic_ctl server start