Null Pointer Dereference Vulnerability in Apache Traffic Server

CVE-2026-112381

What is CVE-2026-112381?

A null pointer dereference vulnerability exists within Apache Traffic Server that can cause the application to crash. This issue arises when a client sends a POST request that overlaps with a chunked response processing scenario, specifically during a reentrant write-ready callback. This timing-dependent race condition, linked to previous backports from CVE-2021-32564, necessitates immediate upgrades to avoid service interruptions. Users are advised to update to versions 9.2.16, 10.1.5, or 10.2.1 to resolve the issue.

References