CVE-2026-65324: Apache Traffic Server DoS Vulnerability

CVE-2026-65324 Overview

CVE-2026-65324 is a resource exhaustion vulnerability [CWE-400] in Apache Traffic Server (ATS). The proxy drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses. A slow client can hold streams open and force the server to buffer unbounded response data in memory. The flaw affects Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. The Apache Software Foundation released fixed builds in versions 9.2.15 and 10.1.4.

Critical Impact
A remote, unauthenticated attacker can exhaust server memory and cause a denial of service by intentionally reading responses slowly across HTTP/2 or HTTP/3 streams.

Affected Products

Apache Traffic Server 8.0.0 through 8.1.9
Apache Traffic Server 9.0.0 through 9.2.14
Apache Traffic Server 10.0.0 through 10.1.3

Discovery Timeline

2026-07-29 - CVE-2026-65324 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-65324

Vulnerability Analysis

Apache Traffic Server acts as a caching forward and reverse proxy. When upstream origins return chunked HTTP/1.1 responses, ATS dechunks the body before forwarding it to HTTP/2 or HTTP/3 clients. During this dechunking path, the per-stream buffer cap that normally limits how much data ATS holds in memory for a single client stream is dropped.

A client that reads response bytes slowly, or advertises a small HTTP/2 flow-control window, causes the proxy to keep queuing dechunked data indefinitely. Because the cap is bypassed, the buffered response can grow without limit. Multiplying this behavior across many concurrent streams or connections drives the ATS process toward memory exhaustion.

The issue is classified as Uncontrolled Resource Consumption [CWE-400]. The attack requires no authentication and no user interaction. Exploitation targets availability only; confidentiality and integrity are not directly affected.

Root Cause

The root cause is a missing enforcement of the per-stream buffer size limit in the code path that dechunks HTTP/1.1 chunked responses for delivery over HTTP/2 or HTTP/3. The cap that governs the intermediate buffer is not applied during this transformation, so back-pressure from a slow reader translates into unbounded server-side buffering.

Attack Vector

The attack vector is network-based. An attacker connects to an ATS-fronted service over HTTP/2 or HTTP/3, requests any resource served through a chunked upstream response, and then drains the stream slowly. Repeated slow-read streams across one or more connections force ATS to retain increasing amounts of dechunked body data in memory until the process is killed by the operating system or fails to allocate.

No authenticated session, special header, or malformed request is required. Any endpoint that returns chunked upstream content is a candidate target. See the Apache Security Discussion Thread for the maintainers' description of the flaw.

Detection Methods for CVE-2026-65324

Indicators of Compromise

Sustained growth of the traffic_server process resident set size (RSS) without a matching increase in request rate.
Out-of-memory (OOM) kill events for traffic_server in dmesg or systemd journal logs.
Elevated counts of long-lived HTTP/2 or HTTP/3 streams with very low client-side throughput.
Client IPs advertising unusually small HTTP/2 WINDOW_UPDATE increments across many parallel streams.

Detection Strategies

Alert on traffic_server RSS or heap usage crossing a baseline threshold sustained over several minutes.
Correlate ATS access logs with per-connection duration and bytes-sent rate to flag slow-read patterns.
Monitor the ratio of open HTTP/2 or HTTP/3 streams to completed transactions per source IP.
Track upstream responses that use Transfer-Encoding: chunked and are served to HTTP/2 or HTTP/3 downstreams.

Monitoring Recommendations

Ingest ATS metrics such as proxy.process.http2.current_client_streams and memory counters into a central telemetry pipeline.
Add OOM-killer events for the ATS binary to security monitoring dashboards.
Alert on abnormal concurrency from single source IPs against HTTP/2 or HTTP/3 listeners.

How to Mitigate CVE-2026-65324

Immediate Actions Required

Upgrade Apache Traffic Server to 9.2.15 on the 9.x branch or 10.1.4 on the 10.x branch.
Inventory all ATS instances, including containerized deployments, and confirm the running binary version.
Restart ATS after upgrade and validate that HTTP/2 and HTTP/3 listeners resume normal operation.
Review recent OOM and memory-pressure events to identify possible prior exploitation attempts.

Patch Information

The Apache Software Foundation fixed the missing buffer cap in Apache Traffic Server 9.2.15 and 10.1.4. Users on the 8.x branch, which reached its final vulnerable release at 8.1.9, should migrate to a supported 9.2.15+ or 10.1.4+ build. Details are published in the Apache Security Discussion Thread.

Workarounds

Disable HTTP/2 and HTTP/3 listeners on ATS until the patched version is deployed, if operationally acceptable.
Enforce per-source connection and stream concurrency limits at an upstream load balancer or WAF.
Set aggressive idle and stream timeouts on ATS to reduce the window for slow-read exploitation.
Constrain the ATS process with cgroup or systemd memory limits so an OOM condition does not destabilize the host.

bash

# Example: constrain traffic_server memory via systemd drop-in
sudo systemctl edit trafficserver
# In the editor, add:
# [Service]
# MemoryMax=4G
# MemoryHigh=3G
sudo systemctl daemon-reload
sudo systemctl restart trafficserver