Apache Traffic Server CVE-2026-111809

Exploitation requires that the target Apache Traffic Server accept and mishandle HEAD requests that carry a Content-Length or Transfer-Encoding header - a message-framing condition the attacker controls directly in the request, not a server-side configuration toggle. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is needed, and the affected versions (8.0.0-8.1.11, 9.0.0-9.2.15, 10.0.0-10.1.4, 10.2.0) are exploitable in default proxy deployments. The principal limiting factor is architectural: the attacker must be able to route requests through the ATS instance and there must be a differently-parsing upstream/downstream HTTP agent for the desynchronization to be weaponized, which is the normal reverse-proxy/CDN topology where ATS is deployed. Upgrading to 9.2.16, 10.1.5, or 10.2.1 removes the condition.

This is a genuinely high-priority issue, not merely a high-CVSS-but-low-real-risk flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction - the most dangerous profile for an internet-facing component. The scope change (S:C) combined with I:H reflects the nature of HTTP request smuggling: the proxy can be coerced into desynchronizing request boundaries, injecting attacker-controlled requests into other clients' connections or backend streams, which is why integrity impact dominates while confidentiality is only partial (C:L) and availability unaffected (A:N). No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation probability cannot be quantified from the data; status is therefore 'no public exploit identified at time of analysis.' However, request-smuggling bugs in widely deployed proxies/CDN software historically attract rapid weaponization, so the absence of a current POC should not be read as low urgency. There are no conflicting signals: the description (HEAD requests carrying Content-Length or Transfer-Encoding) is fully consistent with the CWE-444 classification and the unauthenticated network vector. Prioritize patching given the unauthenticated, low-complexity profile and the affected component's typical placement at the network edge.

An attacker sends a crafted HEAD request to an internet-facing Apache Traffic Server instance that improperly includes Content-Length or Transfer-Encoding headers, causing the proxy and backend to disagree on where the request ends. The smuggled request body is then interpreted as a new request, letting the attacker poison the cache, bypass access controls, or hijack responses destined for other users. No authentication or user interaction is required (PR:N/UI:N), and no public exploit was identified in the provided data at time of analysis.