Skip to content

CVE record · 1 source

CVE-2026-111805

CVSS 8.6

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value.

Vendor: Apache Software Foundation
Product: Other Apache projects
CVSS: 8.6
EPSS: 0.004 (p35)
Exposure class: Web platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

20

CVE NVD 10d ago

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value.

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from…

CVSS 8.6 Fix available CVE-2026-111805 Apache Software Foundation