CVE-2026-59173: Apache Traffic Server is vulnerable to stalled HTTP/2 flow-control

[Masakazu Kitajo <maskit () apache org>]

Apache Traffic Server is vulnerable to stalled HTTP/2 flow-control.

CVE:
CVE-2026-59173 - DoS vulnerability in HTTP/2 via stalled flow-control
conditions

Severity:
important

Reported By:
Okta Red Team

Vendor:
The Apache Software Foundation

Version Affected:
ATS 9.0.0 to 9.2.13
ATS 10.0.0 to 10.1.2

Mitigation:
9.x users should upgrade to 9.2.14 or later versions
10.x users should upgrade to 10.1.3 or later versions

Reference:
https://www.cve.org/CVERecord?id=CVE-2026-59173