CVE-2026-65100

Analyzed Analyzed - Analysis Complete

HTTP/2 HPACK Header Block Corruption in Apache Traffic Server

Publication date: 2026-07-29

Last updated on: 2026-08-03

Assigner: Apache Software Foundation

Description

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-03

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-65100

Affected Vendors & Products

Vendor	Product	Version / Range
apache	traffic_server	From 10.0.0 (inc) to 10.1.4 (exc)
apache	traffic_server	From 8.0.0 (inc) to 8.1.9 (inc)
apache	traffic_server	From 9.0.0 (inc) to 9.2.15 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-696	The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.

Attack-Flow Graph

Executive Summary

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block was encoded successfully. If encoding fails, the encoder and decoder become out of sync, corrupting subsequent header blocks on the connection.

Detection Guidance

This vulnerability affects Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Detection involves checking the installed version of Apache Traffic Server. Use commands like 'traffic_server -v' or 'apt list --installed | grep trafficserver' (for Debian/Ubuntu) or 'rpm -qa | grep trafficserver' (for RHEL/CentOS) to verify the version.

Impact Analysis

This vulnerability can cause connection issues or disruptions in HTTP/2 traffic handling. It may lead to failed requests, data corruption, or service interruptions for users relying on Apache Traffic Server for web traffic.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized data exposure or integrity issues due to corrupted HTTP/2 header blocks. The issue may lead to improper handling of sensitive data transmitted over affected connections.

Mitigation Strategies

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4, as these versions contain fixes for the issue.

Hi! I’m here to help you understand CVE-2026-65100. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70