Apache Traffic Server CVE-2026-65100

HTTP/2 must be enabled on the Apache Traffic Server instance - the HPACK dynamic table logic is only active for HTTP/2 connections and has no equivalent in HTTP/1.1 processing. The attacker must be able to trigger an HPACK encode failure; the CVSS AC:H rating confirms this requires specific, non-trivial conditions that are not fully detailed in the available advisory text, such as crafted header field values or sizes that exercise the failure path in the encoder. No authentication is required per CVSS PR:N, meaning any client capable of initiating HTTP/2 connections to ATS can attempt to trigger the flaw. Exploitation is limited to corrupting the state of the specific HTTP/2 connection on which the encode failure occurs - other concurrent connections are unaffected.

The provided CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L) yields a Medium score of 4.8, which is broadly consistent with the vulnerability's realistic impact. The AC:H metric is the critical limiting factor: triggering an HPACK encode failure requires specific conditions, meaning casual or automated mass exploitation is unlikely. No EPSS data was included in the input, so probabilistic exploitation likelihood cannot be quantified from this dataset. The vulnerability is not listed in CISA KEV, and no public proof-of-concept exploit has been identified, further supporting a lower-urgency posture compared to actively exploited issues. Confidentiality impact is assessed as None (C:N), which aligns with the nature of the flaw - state corruption does not directly expose data. Integrity (I:L) and Availability (A:L) are both low-level: corrupted header blocks could cause malformed request routing or trigger connection teardown, but the blast radius is confined to a single HTTP/2 connection rather than the entire service. Real-world risk is primarily relevant to deployments where ATS acts as a reverse proxy or CDN edge, where connection-level header corruption could affect downstream systems. This is a genuine issue warranting patching but not an emergency response.

An attacker establishes an HTTP/2 connection to a vulnerable Apache Traffic Server instance and sends crafted header blocks engineered to trigger an HPACK encode failure mid-operation. Because ATS has already updated its dynamic table before detecting the failure, subsequent headers on the connection are encoded against a diverged table state and are decoded incorrectly by the peer. In a reverse-proxy context, this could cause downstream requests to carry malformed or misrouted headers, or prompt the peer to terminate the connection due to HPACK decoding errors. No public POC exists at time of analysis.