CVE-2026-65100

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-65100
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65100.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-65100
Downstream
Published
2026-07-29T09:06:17.226Z
Modified
2026-08-05T03:32:18.409711765Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N CVSS Calculator
Summary
Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode
Details

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-696"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65100.json",
    "cna_assigner": "apache",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "8.0.0"
                },
                {
                    "last_affected": "8.1.9"
                },
                {
                    "introduced": "9.0.0"
                },
                {
                    "last_affected": "9.2.14"
                },
                {
                    "introduced": "10.0.0"
                },
                {
                    "last_affected": "10.1.3"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "8.0.0"
                },
                {
                    "fixed": "8.1.9"
                },
                {
                    "introduced": "9.0.0"
                },
                {
                    "fixed": "9.2.14"
                },
                {
                    "introduced": "10.0.0"
                },
                {
                    "fixed": "10.1.3"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/trafficserver

Affected ranges

Type
GIT
Repo
https://github.com/apache/trafficserver
Events
Introduced
b310e3566f58dd04ec2b15b111ec86ea70e20019
Last affected
796ffd3a329b4b1f2ec0dd51158e62c94914c4ca
Introduced
b14030656330ed623cd1f9efe2f4f9abd9d16e29
Fixed
f671e525110be50452f607fc1f2657f3dba7fe3b
Introduced
3fa146678bc6a061722f4ea930998ae29ad70de3
Fixed
f8be6725daee427fbf88f166f14b10cb5525b220
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "8.0.0"
        },
        {
            "last_affected": "8.1.9"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.2.15"
        },
        {
            "introduced": "10.0.0"
        },
        {
            "fixed": "10.1.4"
        }
    ]
}

Affected versions

8.*
8.0.0
8.0.0-rc4
8.0.1
8.0.1-rc0
8.0.2
8.0.2-rc0
8.0.3
8.0.3-rc0
8.0.4
8.0.4-rc0
8.0.5
8.0.6
8.0.6-rc0
8.0.6-rc1
8.1.0
8.1.0-rc0
8.1.1
8.1.1-rc0
8.1.2-rc0
8.1.3
8.1.3-rc0
8.1.3-rc1
8.1.4
8.1.4-rc0
8.1.5
8.1.5-rc0
8.1.6
8.1.6-rc0
8.1.7
8.1.7-rc0
8.1.8
8.1.8-rc0
8.1.9
8.1.9-rc0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65100.json"