{"id":"CVE-2026-111804","kind":"vulnerability","aliases":["CVE-2026-111804"],"related":[],"title":"Apache Traffic Server: wasm plugin use-after-free lets guest code corrupt memory","description":"Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.\n\n\n\nThis issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.","summary":"Apache Traffic Server's experimental wasm plugin has a use-after-free (CWE-416) in its transaction-close handler. It also forwards unvalidated guest-supplied metric IDs to the internal stats API. Apache rates it Critical, CVSS 3.1 8.2. Only 10.x is affected, and only if the wasm plugin is in use. The advisory does not say whether the attacker must supply the wasm guest. Part of the 15-CVE October 2026 ATS release.","severity":"high","cvss":8.8,"epss":0.00229,"exploited":false,"exploited_at":null,"products":[{"name":"Apache Traffic Server","fixed":["10.1.5","10.2.1"],"affected":">= 10.0.0, <= 10.1.4; 10.2.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apache-traffic-server","runtime","self-hosted","wasm"],"not_affected_if":["managed-hosting","versions-outside-10.0.0-to-10.2.0","wasm-plugin-not-enabled","wasm-plugin-not-loaded"],"how_to_check":"Run 'traffic_server -V' to get the version; 10.0.0-10.1.4 and 10.2.0 are affected. Then check whether the wasm plugin is loaded: grep for wasm (e.g. wasm.so) in plugin.config and remap.config. If it is not loaded, you are very likely not exposed, though the advisory does not say this outright.","fix":"Upgrade to Apache Traffic Server 10.1.5 or 10.2.1. If you cannot upgrade, remove the experimental wasm plugin from plugin.config and remap.config (a workaround suggested by cvefeed, not stated by Apache).","status":"open","published_at":"2026-10-21T19:16:59+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:32:56+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T22:32:56Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Apache Traffic Server to 10.1.5 or 10.2.1.\nAffected range is 10.0.0 through 10.1.4 and 10.2.0.","reach":"network","title":"Apache Traffic Server: wasm plugin use-after-free lets guest code corrupt memory","impact":"high","summary":"Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler. It also forwards unvalidated guest-supplied metric IDs to the internal stats API, so a malicious wasm guest can reach internal behavior beyond its sandbox.","category":"runtime","who_cares":["apache-traffic-server","wasm","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"malicious wasm guest corrupts proxy memory or reaches internal stats API","analyst_note":"Confirm whether the attacker must supply the wasm guest (plugin author or config control) and check the Apache Traffic Server security advisory for exact exploit preconditions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["wasm-plugin-not-enabled","versions-outside-10.0.0-to-10.2.0"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000528,"input_tokens":2972,"output_tokens":462,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether the attacker must supply the wasm guest (plugin author or config control) and check the Apache Traffic Server security advisory for exact exploit preconditions.","search":"'-111804':17A,20A '-2026':16A,19A '-416':47B '10':76B '10.0.0':150C '10.1.4':152C '10.1.5':161C '10.2.0':153C '10.2.1':163C '15':105B '2026':108B '3.1':73B '8.2':74B 'advisori':90B 'affect':79B,145C 'also':55B 'apach':1A,25B,33B,68B,111C,146C 'apache':21A 'apache-traffic-serv':24B 'api':67B,142C 'at':109B 'attack':96B 'close':52B,128C 'code':12A 'corrupt':13A 'critic':71B 'cve':15A,18A,106B 'cvss':72B 'cwe':46B 'experiment':37B,115C 'fix':165C 'forward':56B,131C 'free':9A,45B,123C 'guest':11A,59B,101B,134C 'guest-suppli':58B,133C 'handler':53B,129C 'host':31B 'id':62B,137C 'intern':65B,140C 'issu':144C,167C 'let':10A 'memori':14A 'metric':61B,136C 'must':97B 'octob':107B 'part':102B 'plugin':5A,39B,85B,117C 'rate':69B 'recommend':156C 'releas':110B 'runtim':28B 'say':93B 'self':30B 'self-host':29B 'server':3A,23A,27B,35B,113C,148C 'stat':66B,141C 'suppli':60B,98B,135C 'traffic':2A,22A,26B,34B,112C,147C 'transact':51B,127C 'transaction-clos':50B,126C 'unvalid':57B,132C 'upgrad':158C 'use':7A,43B,88B,121C 'use-after-fre':6A,42B,120C 'user':154C 'version':160C 'wasm':4A,32B,38B,84B,100B,116C 'whether':94B 'x':77B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T19:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111804","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111804","severity":null,"published_at":"2026-10-21T19:16:59+00:00","modified_at":"2026-10-23T22:16:55+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111804:518","url":null,"severity":null,"published_at":"2026-10-23T23:47:31+00:00","modified_at":"2026-10-23T23:47:31+00:00","first_seen_at":"2026-10-23T23:47:31+00:00","fetched_at":"2026-10-23T23:47:31+00:00","note":"Read ATS Oct 2026 advisory + GHSA/CVE record. Advisory does not say who supplies the wasm guest; CVSS 3.1 8.2 AV:N/PR:N is the scorer's view, but exposure needs the experimental wasm plugin loaded. Not checked: social posts, PoC (VulDB says no exploit). Debian bookworm 9.2.5 listed vulnerable by tracker though 9.2.x is not in the CVE affected range: unresolved."},{"source":"epss","external_id":"CVE-2026-111804","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111804","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":1624,"url":"https://trafficserver.apache.org/security-2026-10.html","title":"Apache Traffic Server October 2026 CVE Release","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2168,"url":"https://github.com/advisories/GHSA-286j-qmf9-6g9f","title":"GHSA-286j-qmf9-6g9f (CVE-2026-111804)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}