{"id":"CVE-2026-111816","published":"2026-10-21T19:16:59.330","lastModified":"2026-10-26T10:10:00.140","description":"Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-framing desync.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N","cwes":["CWE-444"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Apache Traffic Server incorrectly accepted malformed HTTP 302 responses with Transfer-Encoding: chunked headers due to a carve-out bypass, leading to cache poisoning and response-framing desync when two peers interpret the same response differently.","exploitability":"Exploitation requires control over an upstream server that sends malformed 302 responses with invalid Transfer-Encoding headers; no authentication or user interaction is needed.","blast_radius":"Successful exploitation allows attackers to poison the cache and serve malicious responses to downstream clients, potentially compromising confidentiality and integrity of cached content.","remediation":"Upgrade to Apache Traffic Server version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","detection":"Defenders may observe inconsistent HTTP response parsing between upstream and downstream peers in access logs, or repeated delivery of malformed 302 responses with Transfer-Encoding: chunked headers that should have been rejected as parse errors.","tags":["cache-poisoning","http-desync","response-splitting","web-cache","trafficserver"],"model":"garnet-coder","analyzedAt":"2026-10-25T08:48:13.793Z"}}