Apache Traffic Server CVE-2026-111805

Exploitation requires that the Apache Traffic Server instance accepts HTTP/2 client connections and proxies to an origin served over HTTP/1.1 - the flaw is triggered by a truncated HTTP/2 Content-Length value that ATS mishandles when relaying to the HTTP/1.1 backend, exhausting that origin's worker pool. No authentication, user interaction, or special attacker privileges are required (PR:N/UI:N), and default proxy configurations fronting HTTP/1.1 origins are exposed. The main limiting factor is deployment topology: environments where ATS does not front an HTTP/1.1 origin (e.g., HTTP/2 end-to-end origins) are not affected, and the impact is restricted to origin availability rather than ATS integrity or confidentiality. Affected only on versions 8.0.0-8.1.11, 9.0.0-9.2.15, 10.0.0-10.1.4, and 10.2.0.

This is a denial-of-service issue (CWE-400, resource exhaustion) in Apache Traffic Server where a truncated HTTP/2 Content-Length value can exhaust the worker pool of a downstream HTTP/1.1 origin. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction - attractive characteristics for a DoS. Notably the impact is confined to availability of a SUBSEQUENT system (SA:H) with no impact on the vulnerable ATS instance itself (VC:N/VI:N/VA:N); the harm is to the protected origin's worker pool, not to ATS, which is why the official base score is 7.7 (High) rather than Critical. There is no EPSS score, no CISA KEV listing, and no public exploit identified in the provided data, so there is no evidence of active exploitation or weaponization. Overall this is a legitimate, easily-triggered availability risk for ATS deployments fronting HTTP/1.1 origins, but it is not credential-granting or RCE-class; prioritize patching where ATS protects latency- or capacity-sensitive origins, while recognizing exploitation probability signals (EPSS/KEV/POC) are all absent or unknown.

An unauthenticated remote attacker sends crafted HTTP/2 requests with a truncated Content-Length value through an internet-facing Apache Traffic Server proxy. ATS forwards these to the backend HTTP/1.1 origin in a way that ties up origin worker threads, and repeated requests exhaust the origin's worker pool, causing a denial of service for legitimate users. No public exploit code was identified in the provided data.