CVE-2026-111815

Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a…

Risk score: 66/100
CVSS: 10.0 v3.1
Exploit chance (30 days): 0.2%
Published: 21 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate, allowing an attacker to potentially access sensitive information. An attacker could exploit this vulnerability to gain high impact access.
Affected: {'products': ['Apache Traffic Server'], 'packages': [], 'versions': ['8.0.0 through 8.1.11', '9.0.0 through 9.2.15', '10.0.0 through 10.1.4', '10.2.0']}
Fix: Upgrade to version 9.2.16, 10.1.5, or 10.2.1
Exploitation: No known exploitation

Why it is Amber

CVSS 10.0 critical
Remotely exploitable without logging in

References

https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc

Original description

Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

Last activity 21 Oct 2026. Patch Forecast updates every hour.