CVE-2026-111810

{
  "etk_id": "ETK-2026-2354",
  "cve_id": "CVE-2026-111810",
  "display_id": "CVE-2026-111810",
  "ghsa_id": "GHSA-fx98-vw52-fjmw",
  "euvd_id": "EUVD-2026-107501",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unbounded diagnostic logging in Apache Traffic Server",
  "summary": "Apache Traffic Server 9.2.15, 10.1.4, and 10.2.0 can generate excessive diagnostic output when processing requests with numerous internal headers. An unauthenticated remote attacker may consume log storage or related resources by sending such requests to an exposed proxy.",
  "mitigation": "Upgrade Apache Traffic Server to 9.2.16, 10.1.5, or 10.2.1. Until upgraded, restrict untrusted access to the proxy and monitor log growth.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Traffic Server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "9.2.15",
        "10.1.4",
        "10.2.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Apache Traffic Server",
      "purl": null
    }
  ],
  "cwes": [
    400
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 32.0476447,
  "t0_at": "2026-10-21T19:14:50.479000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-21T19:14:50.479000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-21T19:14:50.479000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111810"
    }
  }
}