CVE-2026-111817 Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-111817?
CVE-2026-111817 is a medium-severity vulnerability in Apache Traffic Server, published on 21 Oct 2026.
Official description
Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on by default in 10.x. In 8.1.11 and 9.2.x it is off by default, and those versions are affected only if it is enabled.
This issue affects Apache Traffic Server: 8.1.11, from 9.2.5 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.
Weakness: CWE-400
Which versions are affected by CVE-2026-111817?
How do I fix CVE-2026-111817?
No fix has been published for CVE-2026-111817 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-111817 being exploited?
There is no known exploitation of CVE-2026-111817 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-111817, GHSA-8jj5-9h2j-2r96, UBUNTU-CVE-2026-111817.