CVE-2026-65100
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Risk Assessment
Encoder and decoder state inconsistency can corrupt HTTP/2 communication, cause request processing errors, and potentially disrupt service operation. The risk applies to deployments handling HTTP/2 traffic.
Recommendation
Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4, which fix the issue. Until patched, monitor logs for HTTP/2 protocol errors.
Other vulnerabilities in Apache Traffic Server
See all- CVE-2017-5659High
Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked encoding.
- CVE-2016-5396High
Apache Traffic Server versions 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack.
- CVE-2014-3525High
Unspecified vulnerability in Apache Traffic Server versions 3.x through 3.2.5, 4.x before 4.2.1.1, and 5.x before 5.0.1. This vulnerability may be related to health checks, but its impact and attack vectors are unknown.
- CVE-2026-102795Critical
Apache Traffic Server contains an improper access control vulnerability. This issue affects Apache Traffic Server from 9.0.0 through 9.2.14 and from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15; all 9.2.x releases before 9.2.15 are affected.
- CVE-2026-58162Critical
The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server versions from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3.
- CVE-2026-58155Critical
Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.
- CVE-2026-58150Critical
Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.
- CVE-2026-57834Critical
Apache Traffic Server allows request smuggling when chunked messages are malformed. This issue affects versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.
- CVE-2026-41920Critical
Apache Traffic Server has an Improper Access Control vulnerability. This affects versions from 9.0.0 to 9.1.14 and from 10.0.0 to 10.1.3.
- CVE-2026-33267Critical
Apache Traffic Server has an Improper Input Validation vulnerability. This affects versions from 9.2.0 to 9.2.14 and from 10.1.0 to 10.1.3.
Original NVD description (English source)
Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS