CVE-2026-111816

Summary

Apache Traffic Server incorrectly accepted malformed HTTP 302 responses with Transfer-Encoding: chunked headers due to a carve-out bypass, leading to cache poisoning and response-framing desync when two peers interpret the same response differently.

Exploitability

Exploitation requires control over an upstream server that sends malformed 302 responses with invalid Transfer-Encoding headers; no authentication or user interaction is needed.

Blast radius

Successful exploitation allows attackers to poison the cache and serve malicious responses to downstream clients, potentially compromising confidentiality and integrity of cached content.

Detection

Defenders may observe inconsistent HTTP response parsing between upstream and downstream peers in access logs, or repeated delivery of malformed 302 responses with Transfer-Encoding: chunked headers that should have been rejected as parse errors.

Prioritized remediation

Upgrade to Apache Traffic Server version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.