Key points
- CVE-2026-111816 is rated Critical with a CVSS score of 9.3 by the National Vulnerability Database.
- The flaw involves a Transfer-Encoding chunked bypass that prevents proper rejection of malformed 302 responses.
- Affected versions include all releases from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, and specific 10.x builds.
Apache Traffic Server contains a critical vulnerability that enables cache poisoning and response-framing desynchronization. According to the National Vulnerability Database record for CVE-2026-111816, the server forwards malformed 302 responses that should have been rejected as parse errors. This behavior occurs because a specific carve-out for Transfer-Encoding chunked headers bypasses the standard rejection path. The result is a stored response that different peers can interpret differently.
The issue stems from weaknesses categorized as CWE-444, or universal resource identifier injection. The National Vulnerability Database assigns a CVSS score of 9.3 to this flaw, labeling it Critical. This high severity reflects the potential for attackers to manipulate cached content. Security operations teams monitoring proxy servers should note that the flaw affects how the server handles specific HTTP response codes and encoding headers.
By the numbers
- CVSS 9.3: The National Vulnerability Database rating for CVE-2026-111816, indicating a critical severity level.
- CWE-444: The Common Weakness Enumeration identifier for the underlying issue, classified as universal resource identifier injection.
- 8.0.0 to 10.2.0: The range of Apache Traffic Server versions affected by this specific cache poisoning vulnerability.
What to watch
The vulnerability exists in multiple major version branches of Apache Traffic Server. Affected releases include all versions from 8.0.0 through 8.1.11. The flaw also impacts versions from 9.0.0 through 9.2.15. Additionally, versions 10.0.0 through 10.1.4 and version 10.2.0 are vulnerable. Users of these specific builds are exposed to the risk of cache poisoning via the described mechanism.
The Apache Software Foundation recommends upgrading to patched versions to mitigate this risk. Version 9.2.16, version 10.1.5, and version 10.2.1 are cited as fixes for the issue. These updates address the Transfer-Encoding chunked bypass that allowed malformed 302 responses to be forwarded. Teams should verify their current version against this list to determine if an update is required.
This incident follows previous security concerns for the platform. As Sandbox Gazette reported on 2026-10-22, an unauthenticated argument injection flaw in the experimental magick plugin received a critical CVSS score of 10.0. That earlier issue highlighted vulnerabilities in plugin handling, whereas this new flaw involves core response processing logic. Both events underscore the need for rigorous validation of HTTP inputs and outputs in proxy environments.
Infection and persistence in general
Cache poisoning attacks typically exploit how proxy servers store and serve content. Attackers often send crafted requests that cause the server to store malicious responses. These responses are then served to subsequent users, potentially injecting scripts or redirecting traffic. Analysts usually examine proxy logs for unusual HTTP headers or response codes. They check for discrepancies between request parameters and cached content. Teams should monitor for unexpected redirects or content changes in cached objects. Persistence relies on the cache retaining the malicious entry until expiration or manual purge.
What to do and how to stay safe: Apache Traffic Server
- Review Apache Traffic Server configurations to ensure strict validation of HTTP response codes and headers.
- Monitor proxy logs for malformed 302 responses or unusual Transfer-Encoding chunked usage.
- Verify current software versions against the affected list and upgrade to patched releases if necessary.
- Implement additional monitoring for cache content integrity to detect potential poisoning attempts early.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-111816?
It is a critical vulnerability in Apache Traffic Server that allows cache poisoning via malformed 302 responses.
Which versions of Apache Traffic Server are affected?
Versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 are affected.
How can users fix this issue?
Users should upgrade to version 9.2.16, 10.1.5, or 10.2.1, which contain the fix.
