PT-2026-120792
CVE-2026-111817
·
Published
2026-10-21
·
Updated
2026-10-21
Description by
CVSS 4.0
6.9
MediumMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Apache Traffic Server version 8.1.11
Apache Traffic Server versions 9.2.5 through 9.2.15
Apache Traffic Server versions 10.0.0 through 10.1.4
Apache Traffic Server version 10.2.0
Description
A chunked transfer can stall until the connection times out when the server passes it through with trailers removed. This occurs because the system waits for trailer bytes that have already been dropped. This behavior is triggered by the
proxy.config.http.drop chunked trailers configuration. In version 10.x, this feature is enabled by default, while in versions 8.1.11 and 9.2.x, it is disabled by default and only affects systems where it has been manually enabled.Recommendations
Upgrade Apache Traffic Server version 8.1.11 to 10.1.5 or 10.2.1.
Upgrade Apache Traffic Server versions 9.2.5 through 9.2.15 to 10.1.5 or 10.2.1.
Upgrade Apache Traffic Server versions 10.0.0 through 10.1.4 to 10.1.5.
Upgrade Apache Traffic Server version 10.2.0 to 10.2.1.
As a temporary workaround, disable the
proxy.config.http.drop chunked trailers configuration. Found an issue in the description? Have something to add? Feel free to write us 👾