---
id: "CVE-2026-111804"
kind: "vulnerability"
aliases: ["CVE-2026-111804"]
title: "Apache Traffic Server: wasm plugin use-after-free lets guest code corrupt memory"
severity: "high"
cvss: 8.8
epss: 0.00229
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Apache Traffic Server", "fixed": ["10.1.5", "10.2.1"], "affected": ">= 10.0.0, <= 10.1.4; 10.2.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apache-traffic-server", "runtime", "self-hosted", "wasm"]
not_affected_if: ["managed-hosting", "versions-outside-10.0.0-to-10.2.0", "wasm-plugin-not-enabled", "wasm-plugin-not-loaded"]
published_at: "2026-10-21T19:16:59+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111804", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:47:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-111804", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Apache Traffic Server: wasm plugin use-after-free lets guest code corrupt memory

Apache Traffic Server's experimental wasm plugin has a use-after-free (CWE-416) in its transaction-close handler. It also forwards unvalidated guest-supplied metric IDs to the internal stats API. Apache rates it Critical, CVSS 3.1 8.2. Only 10.x is affected, and only if the wasm plugin is in use. The advisory does not say whether the attacker must supply the wasm guest. Part of the 15-CVE October 2026 ATS release.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apache Traffic Server affected >= 10.0.0, <= 10.1.4; 10.2.0 fixed 10.1.5, 10.2.1

## How to check

Run 'traffic_server -V' to get the version; 10.0.0-10.1.4 and 10.2.0 are affected. Then check whether the wasm plugin is loaded: grep for wasm (e.g. wasm.so) in plugin.config and remap.config. If it is not loaded, you are very likely not exposed, though the advisory does not say this outright.

## Fix

Upgrade to Apache Traffic Server 10.1.5 or 10.2.1. If you cannot upgrade, remove the experimental wasm plugin from plugin.config and remap.config (a workaround suggested by cvefeed, not stated by Apache).

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111804
- 2026-10-23T23:47:31+00:00 analyst — Read ATS Oct 2026 advisory + GHSA/CVE record. Advisory does not say who supplies the wasm guest; CVSS 3.1 8.2 AV:N/PR:N is the scorer's view, but exposure needs the experimental wasm plugin loaded. Not checked: social posts, PoC (VulDB says no exploit). Debian bookworm 9.2.5 listed vulnerable by tracker though 9.2.x is not in the CVE affected range: unresolved.
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-111804

## Documents

- [advisory] Apache Traffic Server October 2026 CVE Release https://trafficserver.apache.org/security-2026-10.html
- [describes] GHSA-286j-qmf9-6g9f (CVE-2026-111804) https://github.com/advisories/GHSA-286j-qmf9-6g9f

## From the sources

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.



This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_