This text was generated using artificial intelligence (AI).Update October 21, 2026: Additionally, CVE-2026-111815, CVE-2026-111812, CVE-2026-111813, CVE-2026-111809, and CVE-2026-111811 (CVSS 10.0) have been disclosed. See details below.
The Apache Software Foundation describes with CVE-2026-111816 a vulnerability in Apache Traffic Server. Incorrect 302 responses may be forwarded under certain conditions, even though they should be rejected as parse errors. This can lead to two communicating parties interpreting the same HTTP response differently.
The vulnerability is classified with CVSS 9.3 and are classified as CWE-444 Several version ranges of Apache Traffic Server are affected. Corrected releases are available.
Improper processing of 302 responses (CVE-2026-111816)
According to the Apache Software Foundation, Apache Traffic Server may forward an incorrect 302 response, even though it should be discarded as a parse error. The special case Transfer-Encoding: chunked bypasses the intended rejection path.
The result is a different interpretation of the same response by two communicating parties. If such a response is cached and later delivered, it can enable cache poisoning as well as a desynchronization of the response framing.
Cache poisoning in this context refers to the storage of a manipulated response in the cache. Subsequent requests may then receive the cached content. In the case of a desynchronization of response framing, the involved systems determine the boundaries of an HTTP response differently.
CVE-2026-111816 is associated with CVSS 9.3 rated (The published CVSS string is).
Other critical vulnerabilities (CVE-2026-111815, CVE-2026-111812, CVE-2026-111813, CVE-2026-111809, CVE-2026-111811)
In addition to CVE-2026-111816, five more critical vulnerabilities in Apache Traffic Server have been announced. These are each rated with CVSS 10.0 and affect the same version ranges:
CVE-2026-111815
CVE-2026-111812
CVE-2026-111813
CVE-2026-111809
CVE-2026-111811
The published CVSS vector for these vulnerabilities is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N and describes a network-based attack without prior authentication and without user interaction. The vulnerabilities potentially allow widespread attacks on confidentiality and integrity.
All five vulnerabilities are fixed in the same patched versions as CVE-2026-111816: 9.2.16, 10.1.5 and 10.2.1.
Affected version ranges and fixes
According to the Apache Software Foundation, the following version ranges are affected:
Apache Traffic Server from 8.0.0 to 8.1.11
Apache Traffic Server from 9.0.0 to 9.2.15
Apache Traffic Server from 10.0.0 to 10.1.4
Apache Traffic Server 10.2.0
The vulnerabilities are fixed in the following versions:
9.2.16
10.1.5
10.2.1
For prioritization, publicly accessible reverse proxy and caching instances relevant, accepting, storing, or forwarding HTTP responses. At the time of publication, no active exploitation is known.
Review and Prioritization
The review should capture the patch status and the actual exposure of the deployed Apache Traffic Server instances. It makes sense to prioritize based on accessibility and the role of the service in the HTTP processing path:
Capture publicly accessible HTTP services with reverse proxy or caching features.
Technically verify the use of Apache Traffic Server.
Compare the installed version with the affected and corrected version ranges.
Prioritize affected systems and apply the provided fixes.
Document systems that cannot be clearly assigned as a review task.
The visibility of a service is not sufficient to determine whether a vulnerable version is in use. Version comparison remains necessary.
For organizations in Germany and Austria that fall under the NIS-2 Directive — implemented in Germany through the NIS2UmsuCG, in Austria through the NISG — reviewing exposed infrastructure components such as Apache Traffic Server is part of the reasonable technical safeguards. Swiss organizations are required to adhere to comparable due diligence obligations according to the revised Information Security Act (ISG) and the requirements of the BACS. If personal data is transmitted through affected instances, the 72-hour notification obligation under Art. 33 GDPR may also be relevant.
Visibility of External Services and Supplier Risks
Apache Traffic Server can be operated as a publicly accessible HTTP service under a customer domain. LocateRisk assists in capturing externally visible systems and deployed software. HTTP headers, server features, and other publicly visible indicators can support a technical assignment for subsequent review.
For the vulnerabilities described here, this perspective can be used for prioritization: visible services related to Apache Traffic Server can be assigned to the responsible teams for verification of the actual software status. However, LocateRisk does not necessarily determine whether a specific vulnerable version is installed.
In addition, continuous vendor risk monitoring can help keep critical security disclosures from technology providers and dependencies in view. The technical review of one's publicly accessible services remains separate and should be aligned with the respective patch status.
Am I affected?
Apache Traffic Server in the versions mentioned above is affected; the vulnerabilities have been fixed in 9.2.16, 10.1.5, 10.2.1. Those who want to know if Apache Traffic Server is even visible in their externally accessible infrastructure can use the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version that has been installed from the outside—the key factor is comparing it with the manufacturer's advisory.
CVE-2026-111816 refers to a vulnerability in Apache Traffic Server where an erroneous 302 response is forwarded when it should have been rejected as a parse error. The special case Transfer-Encoding: chunked bypasses the intended rejection path, which can enable cache poisoning and desynchronization of the response framing. The vulnerability is classified as critical with a CVSS score of 9.3 and classified as CWE-444.
In addition to CVE-2026-111816, five more critical vulnerabilities have been released: CVE-2026-111815, CVE-2026-111812, CVE-2026-111813, CVE-2026-111809, and CVE-2026-111811. These are each rated CVSS 10.0 and affect the same version series. All vulnerabilities are fixed in versions 9.2.16, 10.1.5, and 10.2.1.
This affects Apache Traffic Server from 8.0.0 to 8.1.11, from 9.0.0 to 9.2.15, from 10.0.0 to 10.1.4 as well as version 10.2.0. The vulnerabilities have been fixed in versions 9.2.16, 10.1.5 and 10.2.1. Affected systems should be updated to one of these versions.
At the time of publication, no active exploitation is known. However, since these are network-based attacks that do not require authentication or user interaction, the update of affected instances should be carried out promptly.
Status: October 21, 2026. This article is for general informational purposes and is not a legal, security, or action advisory in individual cases. Security situation and patch availability may have changed since publication; the linked manufacturer advisory is always authoritative. Despite careful research, we assume no liability for the currentness, accuracy, and completeness.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
A rough estimate in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2026-111816
Passive Assessment
Information About the CVEfound or not found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français