CVE-2026-65324CWE-400denial-of-service

CVE-2026-65324

High · published July 29, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
51.1
In the wild
Unconfirmed
What it is

Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00664 · 51.1th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-07-29T13:16Z
Affected products (3)
ProductVersionsFixed in
apache/traffic_server≥ 8.0.0, ≤ 8.1.9—
apache/traffic_server≥ 9.0.0, < 9.2.159.2.15
apache/traffic_server≥ 10.0.0, < 10.1.410.1.4
References (1)
https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d · [email protected]
EPSS history
Timeline
  • 29 JUL 08:17Z
    Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion
    cvelistv5