Apache Traffic Server 9.2.16, 10.1.5 and 10.2.1 fix 15 vulnerabilities, including request smuggling, cache poisoning, a TLS session-resumption bypass of client-certificate checks and a critical flaw in the experimental magick plugin (CVE-2026-111813, CVSS 10.0)

The Apache Traffic Server project announced on 21 October 2026 (02:07 UTC, 10:07 Perth, on its announce list, posted by Masakazu Kitajo) that 15 vulnerabilities are fixed in versions 9.2.16, 10.1.5 and 10.2.1. According to the announcement, affected versions are 9.0.0 to 9.2.15, 10.0.0 to 10.1.4 and 10.2.0 (some flaws affect only 10.x). The two rated critical are in experimental plugins: CVE-2026-111813 (CVSS 3.1 10.0) lets an unauthenticated client control ImageMagick convert arguments through the magick plugin in its default unsigned configuration, and CVE-2026-111804 (CVSS 3.1 8.2, 10.x only) is a use-after-free in the wasm plugin. Others, as described by the project: request smuggling where an origin connection still owed a request body is reused (CVE-2025-31699, 8.9) or an unread Expect: 100-continue body is parsed as a new request (CVE-2025-55702, 8.7); a malformed chunked 302 response being cached and served, allowing cache poisoning (CVE-2026-111816); HEAD-response smuggling (CVE-2026-111809); HTTP/2 worker-pool exhaustion (CVE-2026-111805 and CVE-2026-111808); session sharing that confuses mutual-TLS identities (CVE-2026-111814) and TLS session-ticket resumption bypassing per-SNI verify_client STRICT enforcement (CVE-2026-111815); unauthenticated cache access through the tsmemcache plugin (CVE-2026-111811); the origin_server_auth plugin signing client-controlled AWS headers with the proxy's IAM credentials (CVE-2026-111812); log flooding (CVE-2026-111810); a stalled passthrough transfer when chunked trailers are dropped (CVE-2026-111817); and a null-pointer dereference on a POST half-close with a chunked response (CVE-2026-112381). The announcement says 9.x users should upgrade to 9.2.16, 10.1.x to 10.1.5 and 10.2.x to 10.2.1 or later. The CVE record for CVE-2026-111811 also lists 8.0.0 to 8.1.11 as affected. No exploitation has been reported. Source: Apache Traffic Server security announcement (21 Oct 2026); CVE records.

Product

Apache Traffic Server (caching proxy / CDN edge server) and its plugins

Versions

Affected (ASF): 9.0.0–9.2.15, 10.0.0–10.1.4, 10.2.0 (CVE-2026-111804 10.x only). Fixed: 9.2.16, 10.1.5, 10.2.1. CVE-2026-111811 record also lists 8.0.0–8.1.11.

CVSS

10.0 (CVE-2026-111813, CVSS 3.1); others range 5.3–10.0 per the announcement

Exploited in Australia?

unknown

Patch to

Upgrade to Traffic Server 9.2.16, 10.1.5 or 10.2.1. Until then, disable the experimental magick and wasm plugins and the tsmemcache plugin if loaded, and if you rely on verify_client STRICT for mutual TLS, treat client-certificate enforcement as unreliable on unpatched builds. After upgrading, consider purging caches that may have stored poisoned responses. 8.x is affected by at least CVE-2026-111811 per its CVE record; move off it.

Primary: Apache Traffic Server — [SECURITY] Multiple vulnerabilities fixed in Apache Traffic Server 9.2.16, 10.1.5 and 10.2.1 (announce list, 21 Oct 2026) · Vendor: CVE record — CVE-2026-111813 (magick plugin) · CVE: CVE-2026-111813, CVE-2026-111804, CVE-2025-31699, CVE-2025-55702, CVE-2026-111816, CVE-2026-111809, CVE-2026-111805, CVE-2026-111808, CVE-2026-111814, CVE-2026-111815, CVE-2026-111811, CVE-2026-111812, CVE-2026-111810, CVE-2026-111817, CVE-2026-112381 · CVE record — CVE-2026-111815 (TLS resumption bypasses verify_client STRICT) · CVE record — CVE-2026-111811 (tsmemcache; lists 8.0.0–8.1.11 as affected)

vulnerabilities network cloud