CVE-2026-111808 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache Traffic Server installations should assess exposure and prioritize upgrading to a fixed version. This includes those responsible for Apache Traffic Server installations, vulnerability management, and security teams. Relevant roles include system administrators, security engineers, and IT managers who oversee Apache Traffic Server deployments. They should review the supplied official advisory or CVE record to validate the .

Why it matters

Defenders should care about CVE-2026-111808 because it can lead to worker pool exhaustion in Apache Traffic Server, affecting availability. Relevant roles include those responsible for Apache Traffic Server installations. Supported consequences include potential service disruption and the need for version verification. Action priority is high for exposed systems, but evidence is limited on exploitation and impact.

• Potential worker pool exhaustion
• Need to verify affected versions
• Remediation priority for exposed systems
• Limited information on exploitation and impact

Technical summary

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. The vulnerability allows a client to trigger backend worker-pool exhaustion, potentially leading to service disruption. Defenders should assess exposure and prioritize upgrading to a fixed version. The issue is related to HTTP/2 DATA frame padding underflow. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

Defensive priority

Defenders should prioritize upgrading to version 9.2.16, 10.1.5, or 10.2.1 to fix the issue.

Recommended defensive actions

• Upgrade to version 9.2.16, 10.1.5, or 10.2.1
• Review and update affected versions
• Monitor for potential worker pool exhaustion
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide information on the vulnerability, but details on exploitation and impact are limited. There is no evidence of exploitation in the wild, but defenders should verify affected versions and assess exposure. The CVE record was published on 2026-10-21T19:11:59.516Z and has not been modified since then. Limited information is available on the potential impact and exploitation of this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.