SB2026102311 - Multiple vulnerabilities in Apache Traffic Server
Published: October 23, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 15 vulnerabilities.
1) Argument injection (CVE-ID: CVE-2026-111813)
CWE-ID: CWE-88 - Argument Injection or Modification
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to control image-conversion arguments and potentially execute arbitrary code.
The vulnerability exists due to improper neutralization of command-line arguments in the Apache Traffic Server experimental magick plugin when processing client query strings in its default unsigned configuration. A remote attacker can supply crafted query parameters that are passed unfiltered to ImageMagick convert to alter conversion behavior and potentially execute arbitrary code.
2) Use-after-free (CVE-ID: CVE-2026-111804)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and improperly modify internal statistics.
The vulnerability exists due to a use-after-free in the Apache Traffic Server experimental wasm plugin's transaction-close handler and insufficient validation of guest-supplied metric IDs when forwarding them to the internal statistics API. A remote attacker can trigger affected transaction-close processing or supply invalid guest metric IDs to cause a denial of service or improperly modify internal statistics.
3) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2025-31699)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to smuggle requests past access controls, disrupt other users' requests, or poison the cache.
The vulnerability exists due to improper HTTP request framing in Apache Traffic Server's origin connection pooling when a connection is returned to the shared pool while the origin is still waiting for a declared request body. A remote attacker can send a request without completing its declared body, including one using Expect: 100-continue, so that the origin interprets a later request as leftover body data, enabling request smuggling, request disruption, or cache poisoning.
4) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2025-55702)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to smuggle requests past a front-end proxy and desynchronize responses for other users.
The vulnerability exists due to improper HTTP request framing in Apache Traffic Server when an origin responds to a POST with Expect: 100-continue before reading its body, leaving the unread body to be parsed as another request. A remote attacker can send a crafted POST through a front-end proxy that shares connections to Traffic Server to smuggle a request past the front end and desynchronize other users' responses.
5) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-111816)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to poison the cache and desynchronize HTTP response framing.
The vulnerability exists due to improper rejection of malformed HTTP responses in Apache Traffic Server when the Transfer-Encoding: chunked exception bypasses parse-error rejection for a malformed 302 response. A remote attacker can supply a crafted response that peers interpret differently and that Traffic Server forwards, stores, and serves to poison the cache and desynchronize response framing.
6) Numeric Truncation Error (CVE-ID: CVE-2026-111805)
CWE-ID: CWE-197 - Numeric Truncation Error
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service by exhausting an HTTP/1.1 origin's worker pool.
The vulnerability exists due to improper handling of truncated Content-Length values in Apache Traffic Server when processing HTTP/2 requests for an HTTP/1.1 origin. A remote attacker can send a crafted HTTP/2 request with a Content-Length value subject to truncation to exhaust the backend worker pool and cause a denial of service.
7) Integer underflow (CVE-ID: CVE-2026-111808)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service by exhausting an HTTP/1.1 origin's worker pool.
The vulnerability exists due to an integer underflow in Apache Traffic Server's HTTP/2 DATA frame padding handling when processing a malformed padded frame. A remote attacker can send a specially crafted padded HTTP/2 DATA frame to exhaust the backend HTTP/1.1 worker pool and cause a denial of service.
8) Incorrect authorization (CVE-ID: CVE-2026-111814)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause requests to use an unintended client-certificate identity at the origin, potentially gaining unauthorized access to or modifying protected resources.
The vulnerability exists due to insufficient client-certificate identity matching in Apache Traffic Server's default outbound session-sharing policy when reusing pooled TLS sessions. A remote attacker can trigger a transaction configured for one client certificate that instead reuses a session authenticated with another certificate to access origin resources under the unintended identity.
The default server_session_sharing.match setting omits MASK_CERT.
9) Missing Authentication for Critical Function (CVE-ID: CVE-2026-111815)
CWE-ID: CWE-306 - Missing Authentication for Critical Function
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass client-certificate authentication and potentially access or modify protected resources.
The vulnerability exists due to missing client-certificate re-verification in Apache Traffic Server's TLS session ticket resumption when resuming a session across SNI virtual hosts. A remote attacker can resume a session established for one virtual host at another host requiring verify_client STRICT to bypass that host's client-certificate requirement and potentially access or modify protected resources.
10) Resource exhaustion (CVE-ID: CVE-2026-111810)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service through excessive diagnostic logging.
The vulnerability exists due to unthrottled diagnostic logging in Apache Traffic Server when stripping internal @ headers from requests. A remote attacker can send requests containing many such headers to generate one diagnostic log line per stripped header, amplifying log output and exhausting resources to cause a denial of service.
11) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-111809)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to smuggle HTTP requests, potentially bypassing request-processing controls or exposing other users' data.
The vulnerability exists due to inconsistent HTTP request framing in Apache Traffic Server when handling HEAD requests carrying Content-Length or Transfer-Encoding. A remote attacker can send specially crafted HEAD requests containing these headers to exploit inconsistent message-boundary interpretation and smuggle requests, potentially bypassing controls or exposing other users' data.
12) Missing Authentication for Critical Function (CVE-ID: CVE-2026-111811)
CWE-ID: CWE-306 - Missing Authentication for Critical Function
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to read, modify, or delete shared proxy-cache contents, compromising confidentiality, integrity, and availability.
The vulnerability exists due to missing authentication in the Apache Traffic Server experimental tsmemcache plugin when exposing the shared proxy cache over the network. A remote attacker can issue cache read, write, and deletion operations through the plugin's network interface to disclose cached data, alter cache contents, or disrupt cache availability.
13) Unintended Proxy or Intermediary (CVE-ID: CVE-2026-111812)
CWE-ID: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to obtain signatures for attacker-chosen AWS request headers under the proxy's IAM credentials, potentially enabling unauthorized access to or modification of AWS resources.
The vulnerability exists due to a confused-deputy weakness in the Apache Traffic Server origin_server_auth plugin when signing client-controlled AWS request headers. A remote attacker can submit chosen AWS headers for signing under the proxy's credentials to perform requests with the proxy's IAM authority, potentially accessing or modifying resources without authorization.
14) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-111817)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service by stalling chunked transfers until connection timeout.
The vulnerability exists due to incorrect transfer-state tracking in Apache Traffic Server's chunked passthrough handling when proxy.config.http.drop_chunked_trailers removes trailer bytes that the transfer logic continues waiting for. A remote attacker can trigger processing of a chunked transfer containing trailers to stall the transfer until timeout and degrade service availability.
Trailer dropping is enabled by default in 10.x; in 9.2.x, exploitation requires explicitly enabling it.
15) NULL pointer dereference (CVE-ID: CVE-2026-112381)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash Apache Traffic Server and cause a denial of service.
The vulnerability exists due to a null pointer dereference in Apache Traffic Server's net_write_io when a POST request is torn down through a half-close while a chunked origin response is reparsed from a reentrant write-ready callback. A remote attacker can time a POST connection half-close to trigger this race, crash the proxy, and cause a denial of service.
Remediation
Install update from vendor's website.