Live › vulnerability › CVE-2026-111804
Go to dashboardApache Traffic Server's experimental wasm plugin has a use-after-free (CWE-416) in its transaction-close handler. It also forwards unvalidated guest-supplied metric IDs to the internal stats API. Apache rates it Critical, CVSS 3.1 8.2. Only 10.x is affected, and only if the wasm plugin is in use. The advisory does not say whether the attacker must supply the wasm guest. Part of the 15-CVE October 2026 ATS release.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Apache Traffic Server | vendor | >= 10.0.0, <= 10.1.4; 10.2.0 | 10.1.5, 10.2.1 |
traffic_server -V to get the version; 10.0.0-10.1.4 and 10.2.0 are affected10.1.5 or 10.2.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.
This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-111804")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.