Apache Traffic Server CVE-2026-111810

Exploitable against any reachable Apache Traffic Server 9.2.15, 10.1.4, or 10.2.0 instance that processes requests containing internal '@' headers, which ATS strips and logs by default - no special configuration or authentication is required (AV:N/PR:N/UI:N). The practical limiting factor is impact magnitude rather than access: an attacker must send sustained volumes of requests carrying many @ headers to meaningfully amplify log writes, and the damage depends on log-storage sizing, log rotation/retention policy, and diagnostic logging verbosity, so deployments with constrained or unrotated log volumes are most at risk.

This is a network-reachable, unauthenticated denial-of-service via log amplification (CWE-400). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a remote attacker needs no privileges, no user interaction, and low complexity, and the impact profile is availability-only (VA:H) with zero confidentiality or integrity impact (VC:N/VI:N) - consistent with the description of excessive diagnostic log writes rather than code execution or data exposure. The headline 8.7 score is driven almost entirely by the availability metric and the trivial, unauthenticated reachability. However, real-world severity is moderated by two factors not reflected in the base score: no EPSS probability was supplied, there is no KEV listing, and no public POC was identified, so there is currently no evidence of active or imminent exploitation. The amplification is also log/disk-oriented (an attacker must sustain many @-header-laden requests to exhaust log storage or I/O), which is a resource-exhaustion nuisance rather than an instant crash - this makes it a patch-soon operational-hardening issue rather than a drop-everything emergency, though internet-facing proxies with verbose diagnostic logging should prioritize it.

An attacker sends HTTP requests to an internet-facing Apache Traffic Server proxy, each request packed with a large number of internal '@' headers. Because ATS writes one unthrottled diagnostic log line per stripped @ header, a modest stream of such requests forces the proxy to generate log volume far exceeding the request traffic, exhausting disk space or log I/O and degrading or denying service. No authentication, user interaction, or special privileges are required, and no public exploit code is currently known.