CVE-2026-59173 — Apache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions

CVE-2026-59173

Apache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions PUBLISHED

Description (CNA)

Uncontrolled Resource Consumption vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.13, from 10.0.0 through 10.1.2. Users are recommended to upgrade to version 9.1.14 or 10.1.3, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Traffic Server	affected 9.0.0 through 9.2.13; affected 10.0.0 through 10.1.2

CWE

CWE-400

References

https://lists.apache.org/thread/lhlbhphmv5dsfgx1fx84mgonzbocpzhd

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/07/17/5

CISA-ADP

No English description supplied.

No references supplied.