{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"trafficserver","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":[],"id":"tcs_01M5NQ4E6D75622ZAHWTGZ847G","modified_at":"2026-10-23T18:05:32.402952289Z","published_at":"2026-10-21T20:17:22.780Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-111810","https://security-tracker.debian.org/tracker/CVE-2026-111810"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-111810","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-111810"}],"summary":"Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more"}