CVE-2026-111804

HighCVSS 8.2/10Last modified Oct 23, 2026

Description

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.

This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0.

Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-416

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 21, 2026
Last modified
Oct 23, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1118058.6Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affCVE-2026-1118088.6Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affectCVE-2026-1118099.3Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects ApachCVE-2026-111816.3Inappropriate implementation in Media Session in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policyCVE-2026-1118107.5Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a requeCVE-2026-1118119.0Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. CVE-2026-11181210.0Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own cCVE-2026-11181310.0Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsiCVE-2026-11181410.0Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate forCVE-2026-11181510.0Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed hoCVE-2026-1118169.3Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chuCVE-2026-1118175.3Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers
CVE-2026-111804: High severity, CVSS 8.2 | Vulnix