CVE-2026-112381CWE-476
CVE-2026-112381
Medium · published October 22, 2026
What it is
Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports.
This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
The record
Technical detail
- CVSS v3.1
- 5.9 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v4.0
- 8.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- EPSS
- 0.00256 · 16.2th percentile
- Weakness
- CWE-476 · NULL Pointer Dereference
- Published
- 2026-10-22T00:17Z
References (1)
EPSS history
Timeline
23 OCT 03:55Z
EPSS moved — → 0%
epss
21 OCT 19:20Z
Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response
cvelistv5
21 OCT 19:20Z
Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response
cvelistv5