Skip to content

CVE record · 1 source

CVE-2026-111808

CVSS 8.6

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.

Vendor: Apache Software Foundation
Product: Other Apache projects
CVSS: 8.6
EPSS: 0.004 (p35)
Exposure class: Web platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

20

CVE NVD 10d ago

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0…

CVSS 8.6 Fix available CVE-2026-111808 Apache Software Foundation