Executive brief
Apache Traffic Server, a high-performance web proxy used to manage and speed up internet traffic, contains a flaw in how it handles encrypted web headers. An attacker could potentially cause the system to lose synchronization with connected users, leading to corrupted data transfers. This results in a denial of service for specific web connections, impacting the reliability of the service for affected users.
Technical details
A synchronization vulnerability exists in Apache Traffic Server's HTTP/2 implementation. The HPACK encoder updates its dynamic table state before verifying that the header block was successfully encoded. If an encoding failure occurs, the encoder's state becomes desynchronized from the peer decoder's state. This desynchronization results in the corruption of all subsequent header blocks on that specific connection. The issue is resolved in versions 9.2.15 and 10.1.4.
Affected products
- Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, 10.0.0 through 10.1.3
Timeline
- 2026-07-29: disclosed
- 2026-07-29: advisory