Apache Traffic Server CVE-2026-111816

Traffic Server must be deployed as a caching/forwarding proxy and must handle a malformed 302 response whose Transfer-Encoding: chunked header triggers the rejection-bypass carve-out; the attacker needs the ability to elicit or inject such an upstream response (e.g., control of or influence over an origin/backend, or a shared cache serving multiple tenants) so that two peers parse the framing differently. Per the CVSS vector exploitation is remote and unauthenticated (AV:N/PR:N/UI:N) against affected versions; the practical limiting factor is that a desynchronizing malformed response must actually traverse the proxy, and non-caching or non-proxying deployments reduce the blast radius since the primary impact is poisoning a shared cache.

This is a genuine high-priority issue, not an inflated-CVSS artifact. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N, 9.3) is internally consistent with the description: a remote, unauthenticated, low-complexity flaw whose scope change (S:C) reflects that cache poisoning and response-framing desync affect downstream clients beyond Traffic Server itself, with high integrity impact (I:H) and only limited confidentiality (C:L) and no availability impact. CWE-444 (HTTP request/response smuggling/desync) matches the described chunked-encoding parsing discrepancy. Signals are partly incomplete: there is no EPSS score, no CISA KEV listing, and no indication of public POC in the input, so exploitation status is 'no public exploit identified at time of analysis.' The absence of KEV/EPSS does not lower the inherent severity - smuggling/cache-poisoning flaws in a caching proxy are reliably weaponizable against shared infrastructure once techniques are public. The 'Authentication Bypass' tag is loosely applicable (smuggling can enable request routing/auth-boundary bypass downstream) but the core impact described is cache poisoning and response desync, so treat auth-bypass as a secondary consequence rather than a confirmed primary effect. Overall: patch promptly on any ATS deployment acting as a shared cache/proxy.

An attacker induces or controls an upstream response - a malformed 302 carrying Transfer-Encoding: chunked - that Traffic Server forwards instead of rejecting as a parse error. Because the proxy and a downstream client/cache parse the response boundaries differently, the attacker splices a poisoned entry into the shared cache that is then served to other users, or desynchronizes the response stream to smuggle an attacker-chosen response. No authentication is required (PR:N) and complexity is low (AC:L); no public exploit code is identified at time of analysis.