CVE-2026-111817: 
Apache Traffic Server vulnerability analysis and mitigation

CVE-2026-111817 is a Denial of Service vulnerability in Apache Traffic Server caused by improper handling of chunked HTTP transfers when the proxy.config.http.drop_chunked_trailers feature is enabled. When trailer dropping is active, the server removes HTTP trailer bytes from a proxied chunked transfer but then continues to wait for those same bytes, causing the connection to stall until it times out. Affected versions include 8.1.11, 9.2.5 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0; trailer dropping is enabled by default in the 10.x branch, making those versions affected without additional configuration. The vulnerability was disclosed on October 21, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption): Apache Traffic Server drops HTTP chunked transfer trailers per the proxy.config.http.drop_chunked_trailers configuration, but its internal state machine still expects to receive the trailer bytes it has already discarded, causing it to block and hold the connection open indefinitely until the connection timeout fires. This logic flaw means that any chunked HTTP request with trailers, when proxied through an affected ATS instance with trailer dropping enabled, will tie up a server connection for the full duration of the timeout period. No authentication, special privileges, or user interaction is required to trigger the condition — a remote, unauthenticated attacker can send crafted chunked HTTP requests to exploit it (GitHub Advisory, Apache Mailing List).

Successful exploitation causes Apache Traffic Server to stall proxied connections until they time out, degrading or completely denying service to legitimate users. There is no impact on confidentiality or integrity — the vulnerability is limited to availability. Under sustained attack, an adversary could exhaust connection pool resources, leading to widespread service unavailability for all traffic routed through the affected proxy (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is 0.0, reflecting a currently low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Despite the low barrier to exploitation (no authentication or user interaction required), the absence of public exploit code reduces immediate risk.

1. Reconnaissance: Identify internet-facing Apache Traffic Server instances running affected versions (8.1.11, 9.2.5–9.2.15, 10.0.0–10.1.4, or 10.2.0) using tools such as Shodan or Censys, targeting HTTP/HTTPS proxy endpoints.
2. Confirm trailer dropping is enabled: For 10.x targets, trailer dropping is on by default. For 8.1.11 and 9.2.x targets, confirm via banner analysis or configuration exposure that proxy.config.http.drop_chunked_trailers is enabled.
3. Craft malicious chunked HTTP request: Construct an HTTP/1.1 request using chunked transfer encoding that includes HTTP trailers (e.g., a Trailer header declaring a trailer field, followed by chunked body data and a trailer section).
4. Send request to ATS proxy: Transmit the crafted request through the vulnerable ATS proxy. The server will drop the trailer bytes but then stall waiting for them, holding the connection open until timeout.
5. Repeat to exhaust resources: Send a high volume of such requests concurrently to consume available connection slots, causing service degradation or complete unavailability for legitimate clients (GitHub Advisory).

• Network: Elevated number of long-lived, stalled HTTP/HTTPS connections to the ATS proxy that do not complete within expected timeframes; unusual volume of chunked transfer requests with Trailer headers from a single or distributed set of source IPs.
• Logs: ATS access logs showing a high rate of requests that terminate only after the configured connection timeout period; repeated entries for the same client IP with chunked transfer encoding and trailer declarations.
• Process/Resource: Sustained high connection count on the ATS process approaching configured limits; increased memory or file descriptor usage corresponding to stalled connections without corresponding throughput.

Apache has released fixed versions 10.1.5 and 10.2.1, which resolve the stall condition; upgrading is the recommended remediation (GitHub Advisory, Apache Mailing List). For operators unable to upgrade immediately, the workaround is to disable the proxy.config.http.drop_chunked_trailers configuration option — this is already the default for 8.1.11 and 9.2.x, so those versions are only affected if the option was explicitly enabled. Operators on 10.x who cannot upgrade should explicitly set this option to disabled until patching is possible.