# CVE-2026-111810: Apache Traffic Server unthrottled logging on header stripping

Source: https://junglewise.ai/threats/cve-2026-111810-apache-traffic-server-9-2-15-10-1-4-and-10-2-0-write-one  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-111810 · Severity: high · CVSS 7.5 · Published 2026-10-21

Apache Traffic Server, a web proxy and cache, writes excessive diagnostic log lines when processing requests with internal headers. An attacker can send requests with many crafted headers to force the proxy to generate far more log data than the request size, potentially filling disk space and degrading service availability.

Technologies: [Apache Traffic Server](https://junglewise.ai/threats/technologies/traffic-server). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-111810 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111810 being exploited in the wild.

**How severe is CVE-2026-111810?** High severity, with a CVSS score of 7.5, published 21 October 2026.

**Which products and versions are affected?** Apache Traffic Server 9.2.15, 10.1.4, 10.2.0.

**Is there a fix for CVE-2026-111810?** Yes: fixed in 9.2.16, 10.1.5, 10.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111810 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-111810?** Check whether you run Apache Traffic Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 9.2.16, 10.1.5, 10.2.1

## Technical details

Apache Traffic Server fails to throttle diagnostic logging when stripping internal @ headers from requests. An attacker on the network can send HTTP requests containing many @ headers, causing the proxy to write one unthrottled log line per header, resulting in log flooding and potential disk exhaustion or performance degradation.

## Affected products

- Apache Traffic Server 9.2.15, 10.1.4, 10.2.0

## Timeline

- 2026-10-21: disclosed

## References

- [https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc](https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc)

## Related threats

- [Apache Traffic Server null pointer dereference in request tear-down](https://junglewise.ai/threats/cve-2026-112381-apache-traffic-server-can-crash-with-a-null-pointer-dereference)
- [Apache Traffic Server connection stall with chunked transfer trailers dropped](https://junglewise.ai/threats/cve-2026-111817-apache-traffic-server-can-stall-a-chunked-transfer-that-it)
- [Apache Traffic Server TLS session resumption bypass of client certificate verification](https://junglewise.ai/threats/cve-2026-111815-apache-traffic-server-can-resume-a-tls-session-across-sni)
- [Apache Traffic Server TLS session reuse with mismatched client certificates](https://junglewise.ai/threats/cve-2026-111814-apache-traffic-server-s-default-outbound-session-sharing-policy)
- [Apache Traffic Server origin_server_auth AWS request signing bypass](https://junglewise.ai/threats/cve-2026-111812-apache-traffic-server-s-origin-server-auth-plugin-lets-a-client)