CVE-2026-111816

The record

Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-framing desync. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

Affected packages

Related vulnerabilities

• CVE-2026-55613 uhttpd is a small HTTP server. CWE-444
• CVE-2026-55614 uhttpd is a small HTTP server. CWE-444
• CVE-2026-55612 uhttpd is a small HTTP server. CWE-444
• CVE-2026-116127 Starlet versions before 0.33 for Perl send a body in responses to HEAD requests… CWE-444
• CVE-2026-91920 A flaw was found in the ChunkReader component of the Undertow web server, which is used… CWE-444
• CVE-2026-118264 Echo is a Go web framework. CWE-444
• CVE-2026-103995 Response body and chunk parsing would handle non-hex or negative integers incorrectly… CWE-444
• CVE-2026-115823 Starman versions before 0.4019 for Perl send response bodies for HEAD requests… CWE-444