CVE-2026-111809

Summary

Apache Traffic Server versions 8.0.0–8.1.11, 9.0.0–9.2.15, and 10.0.0–10.1.4 (excluding 10.2.0) are vulnerable to HTTP request smuggling (CWE-444) when HEAD requests include Content-Length or Transfer-Encoding headers, allowing attackers to bypass security controls by misaligning request boundaries between proxy and origin server.

Exploitability

Exploitation requires sending specially crafted HEAD requests with conflicting transfer encoding instructions; it is straightforward for an attacker with network access and no authentication, as the vulnerability resides in core HTTP parsing logic.

Blast radius

Successful exploitation could enable attackers to bypass WAF rules, inject malicious requests into other users' sessions, or poison caches, potentially leading to data exposure or unauthorized actions on behalf of legitimate users.

Detection

Look for HEAD requests containing both Content-Length and Transfer-Encoding headers in proxy access logs; such requests are malformed per RFC 7230 and may indicate exploitation attempts.

Prioritized remediation

Upgrade to Apache Traffic Server version 9.2.16, 10.1.5, or 10.2.1 immediately, as these versions contain the official fix for the HEAD request smuggling flaw.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.