Key points
- CVE-2026-111808 carries a CVSS score of 8.6, rated as high severity.
- The vulnerability stems from improper handling of malformed padded HTTP/2 DATA frames.
- Vendors have released patched versions 9.2.16, 10.1.5, and 10.2.1 to fix the issue.
Apache Traffic Server contains a high-severity vulnerability that allows attackers to exhaust the worker pool of an HTTP/1.1 origin server. According to the National Vulnerability Database, this flaw, identified as CVE-2026-111808, enables exploitation through the use of malformed padded HTTP/2 DATA frames. Security teams managing reverse proxies or caching layers should assess their exposure immediately, as the attack vector targets the connection between the proxy and the upstream origin.
The issue is classified under CWE-191, indicating a failure in integer handling or resource management. When the proxy processes these specific malformed frames, it can trigger conditions that drain available worker threads on the backend origin server. This exhaustion can lead to service degradation or denial of service for legitimate users attempting to reach the origin. The severity is rated 8.6 on the CVSS scale, placing it firmly in the high category.
Vulnerability Context
The National Vulnerability Database records show that the flaw exists in how Apache Traffic Server interprets padding within HTTP/2 data frames. Attackers can craft requests that appear valid but contain padding structures that trigger the exhaustion behavior. This mechanism allows a remote attacker to impact the availability of the upstream service without necessarily compromising the proxy itself. The impact is primarily on the origin server's ability to handle concurrent connections, as its worker pool becomes fully occupied by the malicious requests.
Affected Versions
Multiple versions of Apache Traffic Server are susceptible to this attack. The vulnerability affects releases from version 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, and from 10.0.0 through 10.1.4. Additionally, version 10.2.0 is also affected. Organizations running any of these specific versions are exposed to the risk of origin pool exhaustion. The Apache Software Foundation has identified these ranges as vulnerable in the official advisory.
Next steps
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue. These updated releases address the handling of padded HTTP/2 frames and prevent the worker pool exhaustion scenario. System administrators should verify their current installation against the affected version list and apply the appropriate patch. Testing the update in a non-production environment is advisable before widespread deployment to ensure compatibility with existing configurations and traffic patterns.
Signals worth monitoring
Teams usually notice this type of activity through sudden spikes in origin server latency or connection timeouts. Check whether monitoring tools report an increase in HTTP/2 reset frames or unusual padding lengths in data frames. Look for a disparity between proxy throughput and origin response times, indicating the backend is struggling. Containment moves often involve rate-limiting specific client IPs or temporarily disabling HTTP/2 support on the proxy if immediate patching is not possible. Review access logs for repeated malformed frame patterns from single sources.
What to do and how to stay safe: Apache Traffic Server
- Audit your Apache Traffic Server installations to identify if they fall within the affected version ranges listed in the advisory.
- Apply the recommended security updates (9.2.16, 10.1.5, or 10.2.1) as soon as possible to mitigate the risk of worker pool exhaustion.
- Monitor origin server health metrics for signs of resource depletion, such as increased latency or dropped connections, which may indicate exploitation.
- Configure logging to capture HTTP/2 frame details, allowing for easier detection of malformed padded frames that could signal an attack attempt.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-111808?
The National Vulnerability Database assigns a CVSS score of 8.6 to this vulnerability, rating it as high severity.
Which Apache Traffic Server versions are affected by this flaw?
Versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 are affected.
Is there a fix available for this vulnerability?
Yes, users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
