CVE-2026-111808

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-111808", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-16T20:19:38.638Z", "datePublished": "2026-10-21T19:11:59.516Z", "dateUpdated": "2026-10-23T21:22:09.150Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-21T19:11:59.516Z"}, "title": "Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion", "problemTypes": [{"descriptions": [{"description": "CWE-191 Integer Underflow (Wrap or Wraparound)", "lang": "en", "cweId": "CWE-191", "type": "CWE"}]}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "versions": [{"status": "affected", "version": "8.0.0", "lessThanOrEqual": "8.1.11", "versionType": "semver"}, {"status": "affected", "version": "9.0.0", "lessThanOrEqual": "9.2.15", "versionType": "semver"}, {"status": "affected", "version": "10.0.0", "lessThanOrEqual": "10.1.4", "versionType": "semver"}, {"status": "affected", "version": "10.2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.</p><p>This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.</p><p>Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"scenarios": [{"lang": "en", "value": "GENERAL"}], "format": "CVSS", "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.6, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"}}, {"scenarios": [{"lang": "en", "value": "GENERAL"}], "format": "CVSS", "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H"}}], "credits": [{"lang": "en", "value": "Khalilov Moe (LeetProtect)", "type": "reporter"}, {"lang": "en", "value": "The ASF", "type": "reporter"}], "x_generator": {"engine": "scripts/cve_render.py"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-23T20:52:18.296737Z", "id": "CVE-2026-111808", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-23T21:22:09.150Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-111808", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-16T20:19:38.638Z", "datePublished": "2026-10-21T19:11:59.516Z", "dateUpdated": "2026-10-23T21:22:09.150Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-21T19:11:59.516Z"}, "title": "Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion", "problemTypes": [{"descriptions": [{"description": "CWE-191 Integer Underflow (Wrap or Wraparound)", "lang": "en", "cweId": "CWE-191", "type": "CWE"}]}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "versions": [{"status": "affected", "version": "8.0.0", "lessThanOrEqual": "8.1.11", "versionType": "semver"}, {"status": "affected", "version": "9.0.0", "lessThanOrEqual": "9.2.15", "versionType": "semver"}, {"status": "affected", "version": "10.0.0", "lessThanOrEqual": "10.1.4", "versionType": "semver"}, {"status": "affected", "version": "10.2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.</p><p>This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.</p><p>Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"scenarios": [{"lang": "en", "value": "GENERAL"}], "format": "CVSS", "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.6, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"}}, {"scenarios": [{"lang": "en", "value": "GENERAL"}], "format": "CVSS", "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H"}}], "credits": [{"lang": "en", "value": "Khalilov Moe (LeetProtect)", "type": "reporter"}, {"lang": "en", "value": "The ASF", "type": "reporter"}], "x_generator": {"engine": "scripts/cve_render.py"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-111808", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-23T20:52:18.296737Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-23T20:52:19.141Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache Traffic Server", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "8.1.11", "status": "affected", "version": "8.0.0", "versionType": "semver"}, {"lessThanOrEqual": "9.2.15", "status": "affected", "version": "9.0.0", "versionType": "semver"}, {"lessThanOrEqual": "10.1.4", "status": "affected", "version": "10.0.0", "versionType": "semver"}, {"status": "affected", "version": "10.2.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue."}], "id": "CVE-2026-111808", "lastModified": "2026-10-23T22:16:55.653", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "security@apache.org", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@apache.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-111808", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-23T20:52:18.296737Z", "version": "2.0.3"}}]}, "published": "2026-10-21T20:17:22.427", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-191"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "trafficserver: trafficserver: Denial of Service via malformed padded HTTP/2 DATA frame", "id": "2558491", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558491"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-130", "details": ["Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.", "A flaw was found in Apache Traffic Server. A remote attacker can exploit this vulnerability by sending a malformed padded HTTP/2 DATA frame. This issue causes the exhaustion of the backend HTTP/1.1 origin server's worker pool, resulting in a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Upgrade Apache Traffic Server to 9.2.16, 10.1.5, or 10.2.1. As a workaround, disabling HTTP/2 on the proxy (proxy.config.http2.enabled) or restricting HTTP/2 client access reduces exposure to backend worker-pool exhaustion."}, "name": "CVE-2026-111808", "public_date": "2026-10-21T19:11:59Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-111808\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-111808\nhttps://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc"], "statement": "A flaw was found in Apache Traffic Server. A remote attacker can send a malformed padded HTTP/2 DATA frame that causes Traffic Server to exhaust the worker pool of a backend HTTP/1.1 origin server, resulting in denial of service. This issue affects Apache Traffic Server 8.0.0\u20138.1.11, 9.0.0\u20139.2.15, 9.0.0\u201310.1.4, and 10.2.0; it is fixed in 9.2.16, 10.1.5, and 10.2.1. Red Hat does not ship Apache Traffic Server in supported products; the affected relationships are the Fedora and EPEL community streams, which ship trafficserver 10.2.0.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.1.11]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.0,9.2.15]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.0.0,10.1.4]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "10.2.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Traffic Server", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "apache_traffic_server", "vendor": "apache"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.1.11]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.0,9.2.15]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.0.0,10.1.4]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "10.2.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Traffic Server", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "traffic_server", "vendor": "apache"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.1.11]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.0,9.2.15]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.0.0,10.1.4]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "10.2.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Traffic Server", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "apache_traffic_server", "vendor": "apache_software_foundation"}], "created": "2026-10-21T22:45:14.292873+00:00", "updated": "2026-10-29T14:15:07.602782+00:00", "vendors": ["apache", "apache$PRODUCT$apache_traffic_server", "apache$PRODUCT$traffic_server", "apache_software_foundation", "apache_software_foundation$PRODUCT$apache_traffic_server"], "weaknesses": ["CWE-130", "CWE-191"]}