CVE-2026-111817 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache Traffic Server deployments should assess exposure and prioritize upgrading to a fixed version. Affected versions include 8.1.11, 9.2.5 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. The issue can be resolved by upgrading to version 10.1.5 or 10.2.1. Defenders should verify affected versions and upgrade to a fixed version to prevent potential issues. Remediation priority is high for deployments using affected versions of

Why it matters

Defenders should prioritize upgrading to a fixed version of Apache Traffic Server to prevent potential stalls in chunked transfers. Affected versions include 8.1.11, 9.2.5 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. The issue can be resolved by upgrading to version 10.1.5 or 10.2.1.

• Potential stalls in chunked transfers may lead to timeouts and disruptions in service
• Defenders should verify affected versions and upgrade to a fixed version to prevent potential issues
• Remediation priority is high for deployments using affected versions of Apache Traffic Server

Technical summary

Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed until the connection times out. This issue affects Apache Traffic Server versions 8.1.11, 9.2.5 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. The problem arises because it waits for the trailer bytes it has already dropped. This can lead to timeouts and disruptions in service. The issue can be resolved by upgrading to version 10.1.5 or 10.2.1. Defenders should prioritize upgrading to a fixed version of Apache Traffic Server to prevent potential stalls in chunked transfers.

Defensive priority

Defenders should prioritize upgrading to a fixed version of Apache Traffic Server to prevent potential stalls in chunked transfers.

Recommended defensive actions

• Upgrade to version 10.1.5 or 10.2.1 of Apache Traffic Server
• Review and update affected versions of Apache Traffic Server
• Monitor for potential stalls in chunked transfers
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide information on the affected versions of Apache Traffic Server and the recommended upgrade versions. The issue is caused by Apache Traffic Server waiting for trailer bytes it has already dropped, leading to potential stalls in chunked transfers. Defenders should verify affected versions and upgrade to a fixed version to prevent potential issues. The CVE record was published on 2026-10-21T19:20:00.515Z and has not been modified since then. There is no additional information on known or unknown or

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.