{"id":"CVE-2026-111809","published":"2026-10-21T20:17:22.620","lastModified":"2026-10-22T16:56:52.840","description":"Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N","cwes":["CWE-444"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Apache Traffic Server versions 8.0.0–8.1.11, 9.0.0–9.2.15, and 10.0.0–10.1.4 (excluding 10.2.0) are vulnerable to HTTP request smuggling (CWE-444) when HEAD requests include Content-Length or Transfer-Encoding headers, allowing attackers to bypass security controls by misaligning request boundaries between proxy and origin server.","exploitability":"Exploitation requires sending specially crafted HEAD requests with conflicting transfer encoding instructions; it is straightforward for an attacker with network access and no authentication, as the vulnerability resides in core HTTP parsing logic.","blast_radius":"Successful exploitation could enable attackers to bypass WAF rules, inject malicious requests into other users' sessions, or poison caches, potentially leading to data exposure or unauthorized actions on behalf of legitimate users.","remediation":"Upgrade to Apache Traffic Server version 9.2.16, 10.1.5, or 10.2.1 immediately, as these versions contain the official fix for the HEAD request smuggling flaw.","detection":"Look for HEAD requests containing both Content-Length and Transfer-Encoding headers in proxy access logs; such requests are malformed per RFC 7230 and may indicate exploitation attempts.","tags":["request-smuggling","http","web-proxy","cwe-444","head-request"],"model":"garnet-coder","analyzedAt":"2026-10-25T08:48:23.895Z"}}