Description
Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Published: 2026-10-21
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Request Smuggling via malformed HEAD requests
Action: Upgrade
AI Analysis

Impact

Apache Traffic Server allows request smuggling through HEAD requests that include a Content-Length or Transfer-Encoding header. The identified weakness (CWE‑444) means that the proxy may misinterpret request boundaries, which can affect the integrity of traffic forwarded by the server.

Affected Systems

The issue affects Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and the 10.2.0 release. The vulnerability is resolved in versions 9.2.16, 10.1.5, and 10.2.1.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. No EPSS score is available, so the exact exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP HEAD request that carries either a Content-Length or Transfer-Encoding header, implying that remote attackers could exploit the flaw from outside the network if the server is exposed.

Generated by OpenCVE AI on October 22, 2026 at 02:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache Traffic Server to version 9.2.16, 10.1.5, or 10.2.1 to eliminate the request smuggling flaw.
  • Configure the server to reject or normalize HEAD requests that include Content-Length or Transfer-Encoding headers to prevent malformed requests.
  • Monitor incoming HEAD requests and log any anomalous headers to detect smuggling attempts.

Generated by OpenCVE AI on October 22, 2026 at 02:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Description Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Title Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling
Weaknesses CWE-444
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-21T19:16:16.439Z

Reserved: 2026-10-16T20:20:22.546Z

Link: CVE-2026-111809

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-21T20:17:22.620

Modified: 2026-10-21T20:17:22.620

Link: CVE-2026-111809

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T02:30:13Z

Weaknesses
  • CWE-444

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')