# CVE-2026-111809: Apache Traffic Server request smuggling via HEAD requests

Source: https://junglewise.ai/threats/cve-2026-111809-apache-traffic-server-allows-request-smuggling-via-head-requests  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-111809 · Severity: critical · CVSS 9.3 · Published 2026-10-21

Apache Traffic Server, a reverse proxy and web caching system, is vulnerable to request smuggling attacks when processing HEAD requests that include Content-Length or Transfer-Encoding headers. An attacker can exploit this to bypass security controls, poison caches, or direct malicious requests to backend systems. This could lead to data theft, cache corruption, or lateral attacks within a web infrastructure.

Technologies: [Apache Traffic Server](https://junglewise.ai/threats/technologies/traffic-server). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-111809 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111809 being exploited in the wild.

**How severe is CVE-2026-111809?** Critical severity, with a CVSS score of 9.3, published 21 October 2026.

**Which products and versions are affected?** Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, 10.2.0.

**Is there a fix for CVE-2026-111809?** Yes: fixed in Traffic Server 9.2.16, 10.1.5, 10.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111809 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111809?** Check whether you run Apache Traffic Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Traffic Server 9.2.16, 10.1.5, 10.2.1

## Technical details

The vulnerability is a request smuggling flaw in HTTP request parsing that occurs when HEAD requests carry Content-Length or Transfer-Encoding headers. Traffic Server fails to properly handle these headers in HEAD requests, allowing an attacker to craft ambiguous requests that are interpreted differently by the proxy and backend servers. The issue affects versions 8.0.0–8.1.11, 9.0.0–9.2.15, 10.0.0–10.1.4, and 10.2.0, and requires network access to the proxy.

## Affected products

- Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, 10.2.0

## Timeline

- 2026-10-21: disclosed

## References

- [https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc](https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc)

## Related threats

- [Apache Traffic Server null pointer dereference in request tear-down](https://junglewise.ai/threats/cve-2026-112381-apache-traffic-server-can-crash-with-a-null-pointer-dereference)
- [Apache Traffic Server connection stall with chunked transfer trailers dropped](https://junglewise.ai/threats/cve-2026-111817-apache-traffic-server-can-stall-a-chunked-transfer-that-it)
- [Apache Traffic Server TLS session resumption bypass of client certificate verification](https://junglewise.ai/threats/cve-2026-111815-apache-traffic-server-can-resume-a-tls-session-across-sni)
- [Apache Traffic Server TLS session reuse with mismatched client certificates](https://junglewise.ai/threats/cve-2026-111814-apache-traffic-server-s-default-outbound-session-sharing-policy)
- [Apache Traffic Server origin_server_auth AWS request signing bypass](https://junglewise.ai/threats/cve-2026-111812-apache-traffic-server-s-origin-server-auth-plugin-lets-a-client)