CVE-2026-111809: CWE-444 Inconsistent Interpretation of HTTP Requests in Apache Software Foundation Apache Traffic Server

CVE-2026-111809 describes a critical vulnerability in Apache Traffic Server where inconsistent interpretation of HTTP HEAD requests containing Content-Length or Transfer-Encoding headers enables HTTP request smuggling attacks. This flaw affects multiple versions of Apache Traffic Server from 8.0.0 through 10.2.0. The vulnerability is classified under CWE-444, indicating inconsistent handling of HTTP requests that can be exploited to manipulate request processing. The CVSS v3.1 score is 9.3, reflecting a high-impact vulnerability with network attack vector, low attack complexity, no privileges or user interaction required, and scope change. The vulnerability can lead to information disclosure and high integrity impact without affecting availability. Official fixes are available in Apache Traffic Server versions 9.2.16, 10.1.5, and 10.2.1.

Successful exploitation of this vulnerability can allow an attacker to perform HTTP request smuggling via specially crafted HEAD requests, potentially leading to information disclosure and manipulation of request integrity. The vulnerability does not impact availability but can compromise confidentiality and integrity of HTTP traffic processed by the server.

Users should upgrade Apache Traffic Server to versions 9.2.16, 10.1.5, or 10.2.1, which contain official fixes for this vulnerability. Applying these updates will remediate the inconsistent HTTP request interpretation and prevent request smuggling attacks. No other mitigations are specified.