Apache Traffic Server Fixes 15 Flaws, Including CVSS 10.0 Plugin Bug and Cache Poisoning
Do Son 
TL;DR
Apache disclosed 15 Apache Traffic Server vulnerabilities, including a CVSS 10.0 flaw in the experimental magick plugin. Several bugs allow request smuggling and cache poisoning. Versions 9.2.16, 10.1.5 and 10.2.1 fix them.
- Total: 15 CVEs
- Severity: 8 Critical · 6 High · 1 Medium
- Actively exploited: None confirmed
- Highest severity: 10.0 (Critical · CVSSv4) — CVE-2026-111813
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv4) | Type | Status |
|---|---|---|---|
| CVE-2026-111813 | 10 | magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration | Not exploited |
| CVE-2026-111811 | 9.4 | tsmemcache plugin exposes the shared proxy cache over the network with no authentication | Not exploited |
| CVE-2026-111816 | 9.2 | A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out | Not exploited |
| CVE-2025-31699 | 9.1 | Origin connection still owed a request body is reused, enabling request smuggling | Not exploited |
| CVE-2026-111815 | 7.8 | TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement | Not exploited |
| CVE-2026-111814 | 7.8 | Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin | Not exploited |
| CVE-2026-111812 | 7 | origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials | Not exploited |
| CVE-2026-111809 | 6.9 | HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling | Not exploited |
Why It Matters
Traffic Server is a caching proxy that sits in front of large websites and content networks. A poisoned cache can serve bad content to every visitor. Likewise, request smuggling can slip past the proxy’s access controls.
How the Attacks Work
Critical plugin flaws
- CVE-2026-111813 (10.0): the experimental magick plugin “lets an unauthenticated client control ImageMagick convert arguments” in its default setup.
- CVE-2026-111811 (9.4): the experimental tsmemcache plugin allows “unauthenticated network read, write, and deletion of the shared proxy cache.”
Cache poisoning and request smuggling
CVE-2026-111816 (9.2) lets a malformed redirect response through, “allowing cache poisoning and response-framing desync.” Meanwhile, CVE-2025-31699 (9.1) and CVE-2025-55702 can let attackers smuggle requests past the proxy. A HEAD request flaw, CVE-2026-111809, enables smuggling too.
TLS, plugin and denial-of-service bugs
Two TLS flaws can reuse sessions without the right client certificate checks. In addition, the origin_server_auth plugin can sign attacker-chosen AWS headers, and the experimental wasm plugin has a use-after-free. The remaining Apache Traffic Server vulnerabilities cause crashes, log floods or exhausted origin servers.
A regression and a partial fix
One crash bug, CVE-2026-112381, stems from earlier flow-control backports for an older flaw. Separately, the chunked-trailer stall bug, CVE-2026-111817, gets fixes only in 10.1.5 and 10.2.1. On 9.2.x it applies only if trailer dropping is turned on.
Exploitation status
No exploitation in the wild or public proof-of-concept has been confirmed.
Affected Versions
Most flaws affect versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. A few hit only recent releases.
Patch and Mitigation Steps
- Upgrade to Apache Traffic Server 9.2.16, 10.1.5 or 10.2.1.
- Disable experimental plugins such as magick, tsmemcache and wasm if you do not need them.
- Move off the 8.x branch, which has no fixed release listed.
Full details are in the Apache Traffic Server security announcement. Given the critical scores, these Apache Traffic Server vulnerabilities deserve fast patching.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
