PT-2026-120787

CVE-2026-111810

·

Published

2026-10-21

·

Updated

2026-10-21

Description by

CVSS 4.0
8.7
High
MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions Apache Traffic Server version 9.2.15 Apache Traffic Server version 10.1.4 Apache Traffic Server version 10.2.0
Description The proxy writes one unthrottled diagnostic log line for every internal @ header it strips. Consequently, a request containing a large number of these headers causes the proxy to generate significantly more log data than the actual size of the request.
Recommendations Upgrade Apache Traffic Server version 9.2.15 to 9.2.16. Upgrade Apache Traffic Server version 10.1.4 to 10.1.5. Upgrade Apache Traffic Server version 10.2.0 to 10.2.1.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-400: Uncontrolled Resource Consumption
Related identifiers
CVE-2026-111810
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com