Description
Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Published: 2026-10-21
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Request Smuggling via malformed HEAD requests
Action: Upgrade
AI Analysis

Impact

Apache Traffic Server allows request smuggling through HEAD requests that include a Content-Length or Transfer-Encoding header. The identified weakness (CWE‑444) means that the proxy may misinterpret request boundaries, which can affect the integrity of traffic forwarded by the server.

Affected Systems

The issue affects Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and the 10.2.0 release. The vulnerability is resolved in versions 9.2.16, 10.1.5, and 10.2.1.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. No EPSS score is available, so the exact exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP HEAD request that carries either a Content-Length or Transfer-Encoding header, implying that remote attackers could exploit the flaw from outside the network if the server is exposed.

Generated by OpenCVE AI on October 22, 2026 at 02:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache Traffic Server to version 9.2.16, 10.1.5, or 10.2.1 to eliminate the request smuggling flaw.
  • Configure the server to reject or normalize HEAD requests that include Content-Length or Transfer-Encoding headers to prevent malformed requests.
  • Monitor incoming HEAD requests and log any anomalous headers to detect smuggling attempts.

Generated by OpenCVE AI on October 22, 2026 at 02:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 28 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache apache Traffic Server
Apache traffic Server
Apache Software Foundation
Apache Software Foundation apache Traffic Server
Vendors & Products Apache
Apache apache Traffic Server
Apache traffic Server
Apache Software Foundation
Apache Software Foundation apache Traffic Server

Wed, 21 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Description Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Title Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling
Weaknesses CWE-444
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N'}

Subscriptions

Apache Apache Traffic Server Traffic Server
Apache Software Foundation Apache Traffic Server
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-28T01:34:23.820Z

Reserved: 2026-10-16T20:20:22.546Z

Link: CVE-2026-111809

cve-icon Vulnrichment

Updated: 2026-10-28T01:34:18.298Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T20:17:22.620

Modified: 2026-10-28T02:17:01.463

Link: CVE-2026-111809

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-21T19:16:16Z

Links: CVE-2026-111809 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T10:30:04Z

Weaknesses
  • CWE-444

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')