Live › vulnerability › CVE-2026-111811
Go to dashboardThe experimental tsmemcache plugin in Apache Traffic Server exposes the shared proxy cache over the network without authentication. An attacker can read, overwrite, or delete cached content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check whether the tsmemcache plugin is loaded in plugin.config or the plugin list of the running Traffic Server, and check the installed version with traffic_server -V.
Upgrade to 9.2.16, 10.1.5, or 10.2.1 depending on your release line; or disable the tsmemcache plugin.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-111811")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.