CVE-2026-65100: Apache Traffic Server HTTP/2 DoS Flaw

CVE-2026-65100 Overview

CVE-2026-65100 affects Apache Traffic Server, an HTTP proxy and caching platform. The flaw stems from improper ordering of state updates in the HTTP/2 HPACK encoder. Apache Traffic Server updates the HPACK dynamic table before confirming that the header block encoded successfully. When encoding fails, the encoder retains state that the peer decoder never receives, leaving the two sides out of sync. Subsequent header blocks on the connection become corrupted because index references no longer align with entries in the decoder's dynamic table. This class of defect is tracked as [CWE-696] (Incorrect Behavior Order).

Critical Impact
HPACK encoder state desynchronization corrupts subsequent HTTP/2 header blocks on the affected connection, breaking downstream request processing integrity.

Affected Products

Apache Traffic Server 8.0.0 through 8.1.9
Apache Traffic Server 9.0.0 through 9.2.14
Apache Traffic Server 10.0.0 through 10.1.3

Discovery Timeline

2026-07-29 - CVE-2026-65100 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-65100

Vulnerability Analysis

HPACK is the header compression format defined for HTTP/2 in RFC 7541. Both endpoints maintain a synchronized dynamic table of header field entries. The encoder appends entries to its dynamic table and emits index references, while the decoder reconstructs the same table by processing the received header block.

Apache Traffic Server mutates the encoder's dynamic table before verifying the encode operation succeeded. If encoding aborts mid-stream, the encoder table contains entries the decoder never observed. Every subsequent header block on that connection references indices that resolve to different values on each side. The result is silent header corruption that persists for the lifetime of the HTTP/2 connection.

Root Cause

The root cause is a logic ordering defect [CWE-696]. State-modifying operations must be committed only after the operation they support completes successfully. In this case, dynamic table insertion should follow, not precede, confirmation that the header block was emitted. The lack of transactional semantics around the encode path allows partial failures to leak observable state divergence.

Attack Vector

The issue is reachable over the network by any peer capable of establishing an HTTP/2 session with the proxy. An attacker who can induce encode failure conditions on outbound header blocks can force the desynchronization, corrupting header data on shared or subsequent requests handled on the same connection. The vulnerability affects integrity of proxied traffic without requiring authentication.

No verified exploit code is available. See the Apache Mailing List Thread for the upstream discussion.

Detection Methods for CVE-2026-65100

Indicators of Compromise

Elevated rates of HTTP/2 stream resets (RST_STREAM) or COMPRESSION_ERROR connection errors reported by upstream or downstream peers.
Malformed or unexpected header values appearing in logs for requests that traversed the proxy after a prior encode failure.
HTTP/2 GOAWAY frames emitted with compression-related error codes on long-lived connections.

Detection Strategies

Inventory all Apache Traffic Server deployments and compare running versions against the fixed releases 9.2.15 and 10.1.4.
Monitor Traffic Server error logs for HPACK encoding failures and correlate with downstream header validation errors.
Instrument HTTP/2 metrics to track COMPRESSION_ERROR frequency per connection as a signal of desynchronization.

Monitoring Recommendations

Ingest proxy access and error logs into a centralized analytics pipeline to detect anomalous header field values.
Alert on sustained increases in HTTP/2 connection terminations attributed to compression errors.
Track upstream origin 4xx responses that spike immediately after Traffic Server HPACK warnings appear.

How to Mitigate CVE-2026-65100

Immediate Actions Required

Upgrade Apache Traffic Server 9.x deployments to version 9.2.15.
Upgrade Apache Traffic Server 10.x deployments to version 10.1.4.
Migrate Apache Traffic Server 8.x deployments off the unsupported branch to a fixed 9.2.15 or 10.1.4 release.
Restart proxy instances after upgrade to ensure no long-lived HTTP/2 connections retain the vulnerable code path.

Patch Information

The Apache Traffic Server project has released fixed versions 9.2.15 and 10.1.4. These releases reorder the HPACK encoder logic so the dynamic table is only updated after the header block is confirmed to have encoded successfully. Refer to the Apache Mailing List Thread for the official announcement and version guidance.

Workarounds

No vendor-supplied workaround exists; upgrading to a fixed release is the recommended remediation.
Where upgrade is delayed, consider disabling HTTP/2 on affected listeners and serving clients over HTTP/1.1 to bypass the HPACK code path.
Reduce HTTP/2 connection lifetime through shorter idle timeouts to limit the window in which desynchronization can corrupt subsequent header blocks.

bash

# Configuration example: verify installed version and upgrade
traffic_server -V
# Expected fixed output: Apache Traffic Server 9.2.15 or 10.1.4