CVE-2026-65100

EUVD-2026-50235

29.07.2026, 10:16

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	4.8 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 28.66%

Affected Products (NVD)

Vendor	Product	Version
apache	traffic_server	8.0.0 ≤ 𝑥 ≤ 8.1.9
apache	traffic_server	9.0.0 ≤ 𝑥 < 9.2.15
apache	traffic_server	10.0.0 ≤ 𝑥 < 10.1.4

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

trafficserver

bookworm	vulnerable
bookworm (security)	vulnerable
sid	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

trafficserver

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	dne
xenial	needs-triage

Common Weakness Enumeration

CWE-696 - Incorrect Behavior Order
The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways which may produce resultant weaknesses.

References

https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d