CVE-2026-111817

Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on by default in 10.x. In 8.1.11 and 9.2.x it is off by default, and those versions are affected only if it is enabled. This issue affects Apache Traffic Server: 8.1.11, from 9.2.5 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.

• CWE-400

• https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc

Published

Oct 21, 2026

Last Modified

Oct 21, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-111811Apache Traffic Server's experimental tsmemcache plugin allow…9
• CVE-2026-111812Apache Traffic Server's origin_server_auth plugin lets a cli…10
• CVE-2026-111813Apache Traffic Server's experimental magick plugin lets an u…10
• CVE-2026-111814Apache Traffic Server's default outbound session-sharing pol…10
• CVE-2026-111815Apache Traffic Server can resume a TLS session across SNI vi…10
• CVE-2026-111816Apache Traffic Server forwarded a malformed 302 response tha…9.3
• CVE-2026-11182Inappropriate implementation in SVG in Google Chrome prior t…6.5
• CVE-2026-111823Mage OSS through 0.9.80 before 76c4f46 can proceed with sess…9.8
• CVE-2026-111828Improper Validation of Specified Quantity in Input vulnerabi…4.3
• CVE-2026-111829Improper Control of Filename for Include/Require Statement i…6.5
• CVE-2026-11183Out of bounds read in GWP-ASan in Google Chrome prior to 149…6.5
• CVE-2026-111831Missing Authorization vulnerability in WP ManageNinja LLC Fl…5.3