TLS Session Resumption Issue in Apache Traffic Server by Apache
CVE-2026-111815

7.8HIGH

Key Information:

Vendor

Apache
Status
Apache Traffic Server
Vendor
CVE Published:
21 October 2026

What is CVE-2026-111815?

A security flaw in Apache Traffic Server allows the resumption of a TLS session across Server Name Indication (SNI) virtual hosts without adequately re-verifying the client certificate, as mandated by the verify_client STRICT policy of the resumed host. This issue affects several versions of the software, and users are advised to upgrade to the secure versions 9.2.16, 10.1.5, or 10.2.1 to ensure their systems are protected.

Affected Version(s)

Apache Traffic Server 8.0.0 <= 8.1.11

Apache Traffic Server 9.0.0 <= 9.2.15

Apache Traffic Server 10.0.0 <= 10.1.4

References

https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb1...
vendor-advisory

CVSS V4

Score:
7.8
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yonghwa Lee, Xint by Theori
.