TLS Session Reuse Vulnerability in Apache Traffic Server
CVE-2026-111814

7.8HIGH

Key Information:

Vendor

Apache
Status
Apache Traffic Server
Vendor
CVE Published:
21 October 2026

What is CVE-2026-111814?

Apache Traffic Server has a vulnerability in its default outbound session-sharing policy, allowing the reuse of a pooled TLS session authenticated by one client certificate for a transaction requiring a different client certificate. This could lead to potential unauthorized access or exposure of sensitive data. Users are advised to upgrade to the fixed versions 9.2.16, 10.1.5, or 10.2.1 to rectify this issue.

Affected Version(s)

Apache Traffic Server 9.0.0 <= 9.2.15

Apache Traffic Server 10.0.0 <= 10.1.4

Apache Traffic Server 10.2.0

References

https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb1...
vendor-advisory

CVSS V4

Score:
7.8
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Craig Taylor
.