CVE-2026-112381 Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-112381?
CVE-2026-112381 is a high-severity vulnerability in Apache Traffic Server, published on 21 Oct 2026.
Official description
Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports.
This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Weakness: CWE-476
Which versions are affected by CVE-2026-112381?
How do I fix CVE-2026-112381?
No fix has been published for CVE-2026-112381 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-112381 being exploited?
There is no known exploitation of CVE-2026-112381 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-112381, GHSA-vv7x-cx95-rcmh, UBUNTU-CVE-2026-112381.