Executive brief
Apache Traffic Server, a high-performance caching proxy used to manage web traffic, contains a flaw that can cause the service to crash when processing certain POST requests. An attacker could exploit this to disrupt web services and cause an outage for users. Organizations should update to the latest versions or apply the recommended configuration change to prevent service instability.
Technical details
A vulnerability in Apache Traffic Server's POST request handling logic leads to a service crash (Denial of Service). The issue is categorized as incorrect control flow (CWE-670) and is triggered when the server processes specific POST requests while request buffering is enabled. The vulnerability affects versions 9.0.0 through 9.2.12 and 10.0.0 through 10.1.1. It can be exploited remotely over the network without authentication or user interaction. A fix is available in versions 9.2.13 and 10.1.2; a workaround involves disabling request buffering by setting 'proxy.config.http.request_buffer_enabled' to 0.
Affected products
- Apache Traffic Server 9.0.0 through 9.2.12, 10.0.0 through 10.1.1
Timeline
- 2026-04-02: disclosed
- 2026-04-02: advisory