Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-111817 Overview
Apache Traffic Server contains a resource exhaustion flaw in its chunked transfer handling. When the proxy is configured to drop trailers via proxy.config.http.drop_chunked_trailers, it continues to wait for trailer bytes it has already discarded. The connection stalls until it hits the configured timeout, consuming server resources. Trailer dropping is enabled by default in the 10.x branch, exposing those deployments without any configuration change. Versions 8.1.11 and 9.2.x are only affected when the setting is explicitly enabled. The flaw is classified under [CWE-400] Uncontrolled Resource Consumption and is reachable over the network without authentication.
Critical Impact
A remote, unauthenticated attacker can stall chunked HTTP connections through the proxy, exhausting connection slots and degrading availability of downstream services.
Affected Products
- Apache Traffic Server 8.1.11 (when drop_chunked_trailers is enabled)
- Apache Traffic Server 9.2.5 through 9.2.15 (when drop_chunked_trailers is enabled)
- Apache Traffic Server 10.0.0 through 10.1.4 and 10.2.0 (vulnerable by default)
Discovery Timeline
- 2026-10-21 - CVE-2026-111817 published to NVD
- 2026-10-22 - Last updated in NVD database
Technical Details for CVE-2026-111817
Vulnerability Analysis
Apache Traffic Server (ATS) acts as a forward and reverse HTTP proxy. HTTP/1.1 chunked transfer encoding allows a sender to include optional trailer headers after the final zero-length chunk. The proxy.config.http.drop_chunked_trailers directive instructs ATS to strip these trailers from the response forwarded to the client.
The defect lives in the state machine that handles chunked message parsing. After stripping trailer bytes from the outbound stream, the proxy continues to block waiting for those same bytes on the inbound side. The transfer never completes until the inactivity timeout fires, leaving the connection open and holding server resources.
Because trailer dropping is the default behavior in the 10.x branch, every exposed 10.x deployment on versions prior to 10.1.5 or 10.2.1 is affected without any administrator action. Technical discussion is available on the Apache Thread Discussion.
Root Cause
The root cause is a logic error in the chunked body parser. The code path that discards trailer bytes fails to signal end-of-message to the upstream read loop. The parser remains in a waiting state for data it has committed to drop, producing a stall rather than a clean close.
Attack Vector
An attacker sends a crafted HTTP request that elicits or forwards a chunked response containing trailers. With trailer dropping active, the connection hangs until timeout. Repeating this across many parallel requests ties up worker threads and connection slots, producing a denial-of-service condition on the proxy.
No authentication, user interaction, or elevated privileges are required. The attack is purely network-based against any ATS instance reachable at the HTTP layer.
Detection Methods for CVE-2026-111817
Indicators of Compromise
- Elevated counts of ATS connections in a half-closed or waiting-for-body state that persist until the inactivity timeout.
- Spikes in proxy.process.http.transaction_counts.errors.connect_failed or timeout-related transaction counters without corresponding upstream failures.
- Growing socket backlog on ATS listeners with low CPU utilization, indicating threads blocked on I/O waits.
Detection Strategies
- Inspect traffic.out and diags.log for repeated inactivity timeouts tied to chunked responses.
- Correlate client source addresses with abnormally long request durations against the proxy to isolate attacker traffic.
- Review the running configuration for proxy.config.http.drop_chunked_trailers state, especially on 8.1.11 and 9.2.x deployments where enabling it introduces exposure.
Monitoring Recommendations
- Alert on sustained increases in active connections per ATS worker without a matching rise in completed transactions.
- Track connection lifetime percentiles; a shift toward timeout values is a strong signal of exploitation.
- Monitor downstream origin response times to distinguish origin issues from proxy-side stalls.
How to Mitigate CVE-2026-111817
Immediate Actions Required
- Upgrade Apache Traffic Server to version 10.1.5 or 10.2.1, which contain the fix.
- On 9.2.x installations between 9.2.5 and 9.2.15, disable proxy.config.http.drop_chunked_trailers until an upgrade to a patched release is available.
- On 8.1.11, verify proxy.config.http.drop_chunked_trailers is set to 0 if a patched build cannot be deployed immediately.
Patch Information
The Apache Traffic Server project resolved the stall in versions 10.1.5 and 10.2.1. Operators running the 10.x branch should prioritize these upgrades because the vulnerable behavior is active by default. Refer to the Apache Thread Discussion for release coordination details.
Workarounds
- Disable trailer dropping by setting proxy.config.http.drop_chunked_trailers to 0 and reloading the configuration with traffic_ctl config reload.
- Lower proxy.config.http.transaction_no_activity_timeout_in to reduce the window during which stalled connections consume resources, accepting the tradeoff for legitimate slow clients.
- Place a rate limiter or upstream WAF in front of ATS to cap concurrent chunked transfers from a single source address until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
