CVE-2026-111809

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 8.1.11 Apache Traffic Server versions 9.0.0 through 9.2.15 Apache Traffic Server versions 10.0.0 through 10.1.4 Apache Traffic Server version 10.2.0

Description Request smuggling is possible via HEAD requests that include Content-Length or Transfer-Encoding headers.

Recommendations Upgrade versions 8.0.0 through 8.1.11 to version 9.2.16. Upgrade versions 9.0.0 through 9.2.15 to version 9.2.16. Upgrade versions 10.0.0 through 10.1.4 to version 10.1.5. Upgrade version 10.2.0 to version 10.2.1.