Vulnerability · Published Oct 21, 2026 · Assigned by apache

CVE-2026-112381Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response

Medium 5.9

In plain English

A medium-severity null pointer dereference in Apache Traffic Server from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.4%top 71.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports. This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	trafficserver	no fix listed	DEBIAN-CVE-2026-112381
Ubuntu:24.04:LTS	trafficserver	no fix listed	UBUNTU-CVE-2026-112381

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Traffic Server	9.2.1510.1.410.2.0

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc vendor-advisory