CVE-2026-111815

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 8.1.11 Apache Traffic Server versions 9.0.0 through 9.2.15 Apache Traffic Server versions 10.0.0 through 10.1.4 Apache Traffic Server version 10.2.0

Description Apache Traffic Server allows the resumption of a TLS session across SNI virtual hosts without re-verifying a client certificate. This occurs even when the resumed host has a verify client policy set to STRICT, which should require client certificate verification.

Recommendations Upgrade versions 8.0.0 through 8.1.11 to version 9.2.16. Upgrade versions 9.0.0 through 9.2.15 to version 9.2.16. Upgrade versions 10.0.0 through 10.1.4 to version 10.1.5. Upgrade version 10.2.0 to version 10.2.1.