Description
Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Published: 2026-07-29
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming that a header block was encoded successfully. If an encode failure occurs, the encoder remains out of sync with the peer decoder, which can corrupt all subsequent header blocks sent over that connection. The flaw is a logic error that corrupts traffic and may lead to protocol errors or service interruptions, and it falls under CWE‑696 (Unexpected Sign or Overflow).

Affected Systems

All releases of Apache Traffic Server from version 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3 are affected. The issue has been fixed in 9.2.15 and 10.1.4 and later releases.

Risk and Exploitability

The vulnerability receives a CVSS score of 6.3, indicating moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation, and the flaw is not listed in the CISA KEV catalog. Exploitation would require an attacker to send crafted HTTP/2 header blocks to a vulnerable server; the impact is limited to corrupted headers and potential service disruption rather than broader system compromise.

Generated by OpenCVE AI on August 2, 2026 at 08:01 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade all affected installations to Apache Traffic Server 9.2.15 or later, or 10.1.4 or later, to apply the fix.
  • If an upgrade cannot be performed immediately, disable HTTP/2 for the affected servers or restrict HTTP/2 connections to trusted clients to mitigate the risk.
  • Implement application and network monitoring to detect abnormal header parsing errors or connection resets that may indicate an attempt to trigger the desynchronization.

Generated by OpenCVE AI on August 2, 2026 at 08:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 29 Jul 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache traffic Server
Vendors & Products Apache
Apache traffic Server

Wed, 29 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Description Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Title Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode
Weaknesses CWE-696
References
Metrics cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N'}

Subscriptions

Apache Traffic Server
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-07-29T12:10:22.340Z

Reserved: 2026-07-21T17:10:18.202Z

Link: CVE-2026-65100

cve-icon Vulnrichment

Updated: 2026-07-29T12:10:19.079Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-29T10:16:44.523

Modified: 2026-08-03T19:31:56.333

Link: CVE-2026-65100

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T08:15:17Z

Weaknesses