CVE-2026-112381: 
Apache Traffic Server vulnerability analysis and mitigation

CVE-2026-112381 is a NULL Pointer Dereference vulnerability in Apache Traffic Server that can cause the proxy to crash, resulting in a denial of service. It affects Apache Traffic Server versions 9.2.15, 10.1.4, and 10.2.0, and was disclosed on October 21, 2026. The flaw is a timing-dependent race condition introduced by flow-control backports related to CVE-2021-32564. It carries a CVSS v3.1 base score of 5.9 (Medium) and a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, Apache Mailing List).

The root cause is a NULL Pointer Dereference (CWE-476) triggered by a race condition in Apache Traffic Server's HTTP request handling. Specifically, when a client POST request is torn down via a TCP half-close while a chunked origin response is simultaneously being reparsed from a reentrant write-ready callback, the server dereferences a null pointer and crashes. This race was inadvertently introduced during the backporting of flow-control fixes from CVE-2021-32564. The attack requires no authentication or user interaction, but the timing-dependent nature of the race means exploitation is not trivially reproducible on demand (GitHub Advisory, Apache Mailing List).

Successful exploitation causes Apache Traffic Server to crash, resulting in a complete loss of availability for the proxy service. There is no impact to confidentiality or integrity — the vulnerability is purely a denial-of-service condition. Any backend services or clients relying on the Traffic Server instance for proxying would be disrupted until the service is restarted, and repeated exploitation could result in sustained unavailability (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. While no authentication is required, the timing-dependent race condition makes reliable exploitation difficult (GitHub Advisory, Apache Mailing List).

1. Reconnaissance: Identify internet-facing Apache Traffic Server instances running versions 9.2.15, 10.1.4, or 10.2.0 using network scanning tools or service banners.
2. Craft POST request: Prepare an HTTP POST request with a chunked transfer encoding body directed at the vulnerable Traffic Server instance.
3. Initiate half-close: Send the POST request and then perform a TCP half-close (FIN) on the client side while the server is actively processing a chunked origin response — specifically during a reentrant write-ready callback.
4. Trigger race condition: The timing-dependent race between the half-close teardown and the chunked response reparsing causes a null pointer dereference in the server process.
5. Crash the server: Apache Traffic Server crashes, causing a denial of service for all clients relying on the proxy (GitHub Advisory).

• Logs: Unexpected Apache Traffic Server crash logs or core dump files; error messages referencing null pointer dereferences or segmentation faults in the ATS error log (traffic.out or diags.log).
• Process: Sudden termination of the traffic_server process; automatic restarts by the process manager (e.g., traffic_manager) in rapid succession.
• Network: High volume of HTTP POST requests with chunked transfer encoding followed by abrupt TCP connection resets (RST/FIN) from the same or rotating source IPs.
• File System: Presence of core dump files (e.g., core.*) in the Traffic Server working directory following unexpected crashes.

Apache Software Foundation has released patched versions that resolve this issue: upgrade to Apache Traffic Server 9.2.16, 10.1.5, or 10.2.1. No configuration-based workaround has been published; upgrading to a fixed version is the only recommended remediation. Administrators should prioritize patching instances exposed to untrusted networks, as the vulnerability is exploitable without authentication (GitHub Advisory, Apache Mailing List).