CVE-2026-111815: CWE-295 Improper Certificate Validation in Apache Software Foundation Apache Traffic Server

CVE-2026-111815 is a vulnerability in Apache Traffic Server where TLS session resumption across Server Name Indication (SNI) virtual hosts does not properly re-validate client certificates when the resumed host enforces a strict client certificate verification policy. This improper certificate validation (CWE-295) could allow an attacker to bypass client certificate checks when resuming TLS sessions. The vulnerability affects Apache Traffic Server versions >=8.0.0 <=8.1.11, >=9.0.0 <=9.2.15, >=10.0.0 <=10.1.4, and =10.2.0. The vendor has released fixed versions 9.2.16, 10.1.5, and 10.2.1 to address this issue.

This vulnerability has a CVSS 3.1 base score of 10.0 (critical), indicating a network attack vector with no privileges or user interaction required. The impact includes complete confidentiality and integrity compromise (C and I are high), with no availability impact. An attacker could bypass client certificate verification policies during TLS session resumption, potentially allowing unauthorized access or impersonation in environments relying on strict client certificate validation.

Users should upgrade Apache Traffic Server to versions 9.2.16, 10.1.5, or 10.2.1 or later, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory.