CVE-2026-111816

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 8.1.11 Apache Traffic Server versions 9.0.0 through 9.2.15 Apache Traffic Server versions 10.0.0 through 10.1.4 Apache Traffic Server version 10.2.0

Description The software forwarded a malformed 302 response that should have been rejected as a parse error. This occurred because the Transfer-Encoding: chunked carve-out bypassed the rejection path. Consequently, a response that two peers can interpret differently is stored and served, leading to cache poisoning and response-framing desync.

Recommendations Upgrade versions 8.0.0 through 8.1.11 to version 9.2.16 Upgrade versions 9.0.0 through 9.2.15 to version 9.2.16 Upgrade versions 10.0.0 through 10.1.4 to version 10.1.5 Upgrade version 10.2.0 to version 10.2.1