Description
Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.



Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Published: 2026-07-29
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Protocol corruption, possible denial of service
Action: Immediate Patch
AI Analysis

Impact

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully. As a result, an encode failure leaves the encoder out of sync with the peer decoder, corrupting subsequent header blocks on the connection. This logic flaw can cause protocol errors, potentially leading to corrupted traffic and service interruptions, and is classified as CWE-696.

Affected Systems

All releases of Apache Traffic Server from version 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3 are affected. The issue has been fixed in 9.2.15, 10.1.4, and later releases.

Risk and Exploitability

The vulnerability receives a CVSS score of 6.3, indicating moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation, and the flaw is not listed in the CISA KEV catalog. Exploitation would require an attacker to send crafted HTTP/2 header blocks to a vulnerable server; the impact is limited to corrupted headers and potential service disruption rather than broader system compromise.

Generated by OpenCVE AI on October 1, 2026 at 23:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade all affected installations to Apache Traffic Server 9.2.15 or later, or 10.1.4 or later, to apply the fix.
  • If an upgrade cannot be performed immediately, disable HTTP/2 for the affected servers or restrict HTTP/2 connections to trusted clients to mitigate the risk.
  • Implement application and network monitoring to detect abnormal header parsing errors or connection resets that may indicate an attempt to trigger the desynchronization.

Generated by OpenCVE AI on October 1, 2026 at 23:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Wed, 29 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 29 Jul 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache traffic Server
Vendors & Products Apache
Apache traffic Server

Wed, 29 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Description Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Title Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode
Weaknesses CWE-696
References
Metrics cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N'}

Subscriptions

Apache Traffic Server
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-01T17:06:34.984Z

Reserved: 2026-07-21T17:10:18.202Z

Link: CVE-2026-65100

cve-icon Vulnrichment

Updated: 2026-07-29T12:10:19.079Z

cve-icon NVD

Status : Modified

Published: 2026-07-29T10:16:44.523

Modified: 2026-10-01T18:17:26.850

Link: CVE-2026-65100

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T23:30:14Z

Weaknesses