# CVE-2026-111815: Apache Traffic Server TLS session resumption bypass of client certificate verification

Source: https://junglewise.ai/threats/cve-2026-111815-apache-traffic-server-can-resume-a-tls-session-across-sni  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-111815 · Severity: critical · CVSS 10 · Published 2026-10-21

Apache Traffic Server is a caching proxy that handles TLS connections for web traffic. An attacker can reuse a TLS session across different virtual hosts protected by SNI (Server Name Indication) to bypass client certificate verification requirements, potentially gaining unauthorized access to services that should require certificate-based authentication.

Technologies: [Apache Traffic Server](https://junglewise.ai/threats/technologies/traffic-server). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-111815 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111815 being exploited in the wild.

**How severe is CVE-2026-111815?** Critical severity, with a CVSS score of 10, published 21 October 2026.

**Which products and versions are affected?** Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, 10.2.0.

**Is there a fix for CVE-2026-111815?** Yes: fixed in 9.2.16, 10.1.5, 10.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111815 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111815?** Check whether you run Apache Traffic Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 9.2.16, 10.1.5, 10.2.1

## Technical details

The vulnerability exists in TLS session resumption handling within SNI virtual host configurations. When a client resumes a TLS session across different SNI virtual hosts, Traffic Server fails to re-verify the client certificate even when the resumed host's verify_client policy is set to STRICT. This allows an attacker with a valid session on one host to connect to a different host that should enforce mandatory client certificate verification.

## Affected products

- Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, 10.2.0

## Timeline

- 2026-10-21: disclosed

## References

- [https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc](https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc)

## Related threats

- [Apache Traffic Server null pointer dereference in request tear-down](https://junglewise.ai/threats/cve-2026-112381-apache-traffic-server-can-crash-with-a-null-pointer-dereference)
- [Apache Traffic Server connection stall with chunked transfer trailers dropped](https://junglewise.ai/threats/cve-2026-111817-apache-traffic-server-can-stall-a-chunked-transfer-that-it)
- [Apache Traffic Server TLS session reuse with mismatched client certificates](https://junglewise.ai/threats/cve-2026-111814-apache-traffic-server-s-default-outbound-session-sharing-policy)
- [Apache Traffic Server origin_server_auth AWS request signing bypass](https://junglewise.ai/threats/cve-2026-111812-apache-traffic-server-s-origin-server-auth-plugin-lets-a-client)
- [Apache Traffic Server tsmemcache plugin unauthenticated cache access](https://junglewise.ai/threats/cve-2026-111811-apache-traffic-server-s-experimental-tsmemcache-plugin-allows)