Is CVE-2026-111809 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111809 being exploited in the wild.

How severe is CVE-2026-111809?

Critical severity, with a CVSS score of 9.3, published 21 October 2026.

Which products and versions are affected?

Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, 10.2.0.

Is there a fix for CVE-2026-111809?

Yes: fixed in Traffic Server 9.2.16, 10.1.5, 10.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-111809 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-111809?

Check whether you run Apache Traffic Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111809: Apache Traffic Server request smuggling via HEAD requests

CVE-2026-111809 · Severity: critical · CVSS 9.3 · Published 2026-10-21

Apache Traffic Server, a reverse proxy and web caching system, is vulnerable to request smuggling attacks when processing HEAD requests that include Content-Length or Transfer-Encoding headers. An attacker can exploit this to bypass security controls, poison caches, or direct malicious requests to backend systems. This could lead to data theft, cache corruption, or lateral attacks within a web infrastructure.

Technologies: Apache Traffic Server. Vendors: Apache.

Quick answers

Is CVE-2026-111809 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111809 being exploited in the wild.
How severe is CVE-2026-111809?: Critical severity, with a CVSS score of 9.3, published 21 October 2026.
Which products and versions are affected?: Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, 10.2.0.
Is there a fix for CVE-2026-111809?: Yes: fixed in Traffic Server 9.2.16, 10.1.5, 10.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111809 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-111809?: Check whether you run Apache Traffic Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Traffic Server 9.2.16, 10.1.5, 10.2.1

Technical details

The vulnerability is a request smuggling flaw in HTTP request parsing that occurs when HEAD requests carry Content-Length or Transfer-Encoding headers. Traffic Server fails to properly handle these headers in HEAD requests, allowing an attacker to craft ambiguous requests that are interpreted differently by the proxy and backend servers. The issue affects versions 8.0.0–8.1.11, 9.0.0–9.2.15, 10.0.0–10.1.4, and 10.2.0, and requires network access to the proxy.

Affected products

Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, 10.2.0

Timeline

2026-10-21: disclosed

References

https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.