CVE-2026-111815

Summary

Apache Traffic Server incorrectly allows TLS session resumption across SNI virtual hosts without re-checking client certificate requirements, meaning a client that previously connected to one host (without a required cert) can reuse that session on another host that mandates STRICT client verification.

Exploitability

Remote exploitation is trivial for an attacker who has already established a TLS session with a non-strict host and then targets a strict host using the same SNI name or overlapping session cache; no user interaction or prior authentication is needed.

Blast radius

An attacker can bypass client certificate enforcement on strict virtual hosts, gaining unauthorized access to resources protected by mutual TLS, potentially leading to data exfiltration or privilege escalation within the TLS-protected scope.

Detection

Log entries showing successful TLS handshakes with resumed sessions on hosts configured with verify_client=STRICT, especially when the original handshake lacked a client certificate, may indicate exploitation; inspect ssl_handshake logs for mismatched certificate presence across resumptions.

Prioritized remediation

Upgrade to Apache Traffic Server version 9.2.16, 10.1.5, or 10.2.1, which explicitly enforce client certificate verification on every TLS handshake, including during session resumption.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.