CVE-2026-65324

CVE-2026-65324 in Apache Traffic Server exposes a critical architectural flaw in how dechunking handles multiplexed connections. When a client sends a chunked HTTP/2 or HTTP/3 response, ATS must reassemble the chunks into a continuous buffer before processing. The vulnerability: this dechunking logic operates without per-stream resource limits, meaning one slow client can force unbounded buffering that starves every other stream sharing the same TCP or QUIC connection. This is not merely a memory exhaustion issue — it's a resource fairness failure. A single malicious client can suppress legitimate traffic on the same connection without triggering server-level alerts, because aggregate memory consumption may stay well below dangerous thresholds. The attacker doesn't need authentication, special access, or high bandwidth. They need only sustain a slow, chunked response delivery that forces ATS to buffer indefinitely per stream. The vulnerability spans ATS versions 8.x through 10.x, indicating this is a structural gap that emerged when dechunking logic was extended to HTTP/2 and HTTP/3, not a recent regression. If you're running any affected version, prioritize patching regardless of current traffic patterns — slow-client DoS is operationally cheap to execute and scales trivially against proxy infrastructure. What to verify: examine the patch diff directly. The fix must enforce buffer limits at dechunk time with stream context — meaning each stream gets its own independent cap. If the patch only applies aggregate connection-level capping, the server process is protected but intra-connection stream fairness remains broken. In that case, one slow client can still silence other users' requests on the same connection, which is a targeted suppression vector rather than simple denial-of-service. For HTTP/3 deployments specifically, the attack surface is larger. QUIC's connection migration and 0-RTT resumption make persistent low-bandwidth attacks harder to distinguish from legitimate mobile users. Assume higher exposure if your ATS handles QUIC traffic. Operational immediate actions: (1) upgrade to a patched version if available, (2) verify whether your ATS configuration has any per-stream buffer limits that were previously documented but ineffective, (3) monitor for follow-on disclosures in the same dechunking code path — aggregate-only fixes in this vulnerability class historically leave residual exposure that gets exploited after initial patching cycles.

Reviewed through automated stages and approved by a human before publication.