Apache Traffic Server CVE-2026-111808

Requires an Apache Traffic Server instance (in an affected 8.x/9.x/10.x range) that accepts HTTP/2 client connections and proxies to an HTTP/1.1 origin - the standard reverse/forward-proxy deployment where HTTP/2 is enabled on the downstream listener. The attacker needs only network reachability to the HTTP/2 listener; no authentication, credentials, or user interaction are required (PR:N/UI:N). Limiting factors: HTTP/2 must be enabled on the client-facing side and there must be an HTTP/1.1 origin behind the proxy for the worker-pool exhaustion to matter; pure HTTP/2-to-HTTP/2 or non-proxying configurations, and instances already on 9.2.16 / 10.1.5 / 10.2.1, are not exposed.

This is a genuine but moderate-priority availability issue, not a high-CVSS-but-theoretical one, and the signals are internally consistent. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated condition requiring no user interaction, with impact confined entirely to availability of a SUBSEQUENT system (SA:H) - the HTTP/1.1 origin whose worker pool is exhausted - and zero confidentiality or integrity impact (VC:N/VI:N/VA:N on the vulnerable Traffic Server itself). The 7.7 score is driven solely by this downstream denial-of-service. No EPSS probability was supplied, there is no CISA KEV listing, and no public exploit code was referenced, so 'no public exploit identified at time of analysis' applies. The main caveats are missing quantitative exploitation data (no EPSS) and a tag/CWE mismatch: the CVE is classified CWE-191 (integer underflow) while the input Tags say 'Integer Overflow' - functionally both describe the same padding-length wrap bug, but the labels disagree and should be verified. Net: a credible, easy-to-trigger DoS worth prioritizing for internet-facing Traffic Server deployments fronting HTTP/1.1 origins, but absent active-exploitation or POC evidence it is not an emergency.

An attacker who can reach a public Apache Traffic Server proxy opens an HTTP/2 connection and sends a malformed padded DATA frame whose padding length triggers an integer underflow (CWE-191) in frame handling. Because the vector is network-reachable, low-complexity, and unauthenticated (AV:N/AC:L/PR:N/UI:N), repeated frames exhaust the worker pool used to service the backing HTTP/1.1 origin, denying service to legitimate traffic. No public exploit code was identified at time of analysis.