Apache Traffic Server Fixes 15 Vulnerabilities, Including CVE-2026-111813 in an Experimental Plugin: Upgrade to 9.2.16, 10.1.5 or 10.2.1

On 20 October 2026, the Apache Traffic Server project released 9.2.16, 10.1.5 and 10.2.1, fixing 15 vulnerabilities in the open-source caching proxy. The highest-scored flaw, CVE-2026-111813, has a CVSS score of 10.0 from the Apache Software Foundation (ASF), the CVE Numbering Authority (CNA) for the project. It sits in the experimental magick plugin, which is not built by default and must be deliberately loaded. Three other flaws also carry a CVSS 3.1 score of 10.0, but each depends on a specific setup: a configured client certificate towards origin servers, per-site client-certificate checks on inbound TLS, or the optional origin_server_auth plugin. The rest are request-smuggling, cache-poisoning and denial-of-service bugs, several of them in the core proxy.

Several points narrow the risk. The ASF rates only two of the 15 flaws Critical, and both are in experimental plugins. The project says its severity rating reflects "the impact and exploitability of the issue in a default configuration," while the CVSS score "can be higher for issues that need specific conditions or a non-default configuration to reach" (Apache Traffic Server advisory). As of 26 October 2026, 08:13 Cyprus time (UTC+2), none of the 15 is in CISA's Known Exploited Vulnerabilities (KEV) catalog, CISA's assessment on 14 of the 15 CVE records lists exploitation as "none", and no source we checked reports attacks. Fixed versions are available for the 9.x and 10.x lines, though one flaw the ASF rates Moderate, CVE-2026-111817, has no 9.2.x fix and affects 9.2.x only in a non-default setting.

Technical Information

What the project says (ASF announcement, 20 October 2026; project advisory page). The ASF lists 15 CVEs: 2 rated Critical, 8 Important and 5 Moderate. It groups them as 5 denial of service, 4 request smuggling, 3 access-control bypass, 1 argument injection, 1 memory safety and 1 spoofing or certificate-trust issue. It asks "users of all affected versions" to upgrade "as soon as possible."

The flaws that need a plugin or a specific configuration. These carry the highest scores. All scores below are the ASF's (CNA) CVSS 3.1 and 4.0 base scores as published on the CVE records; NVD lists every record as "Awaiting Analysis" with no score of its own.

The project's plugin documentation says experimental plugins live in a separate source directory and are compiled only when the build option -DBUILD_EXPERIMENTAL_PLUGINS=ON is set (plugin index). origin_server_auth is a stable plugin, but it does nothing unless an operator configures it. For CVE-2026-111814, the documentation says "deployments that configure no client certificate are unaffected" (records.yaml reference).

The magick plugin flaw in more detail. Abraxas Labs, one of the credited reporters, published a write-up on 13 October, a week before the fix. It describes a lab test against 10.2.0 in which the unsigned magick plugin wrote a file as the Traffic Server user, and labels the result "Not RCE". It also notes that the default plugin.config is empty, so the plugin is inactive unless an operator adds it. The ASF's CVSS 10.0 score assumes worse impact than that lab result, and we report both. Abraxas Labs says a proof of concept exists; we do not link it.

Flaws in the core proxy. These apply without any plugin:

For a caching proxy, request smuggling and cache poisoning matter because one user's crafted request can change what other users receive. The worker-pool flaws affect the origin servers behind Traffic Server rather than the proxy itself.

Exploitation status. CISA's assessment attached to 14 of the 15 CVE records lists exploitation as "none" (the CVE-2026-111809 record carries no CISA assessment yet). None of the 15 is in the KEV catalog (see Sources for the check time). Germany's BSI rates the release "hoch" (high) in WID-SEC-2026-4112, and neither the ASF nor BSI reports attacks.

Timeline (Cyprus time, UTC+3 until 25 October and UTC+2 after, where the source gives a time):

• 13 October 2026: Abraxas Labs publishes its magick plugin write-up, with no CVE assigned at that point.
• 20 October (US time); 21 October, 05:07: ASF's Masakazu Kitajo, for the Traffic Server project management committee, posts "[SECURITY] Multiple vulnerabilities fixed in Apache Traffic Server 9.2.16, 10.1.5 and 10.2.1" to the project's announce and users lists. The Apache release catalog lists all three releases on 20 October.
• 21 October, 21:20–22:20: The ASF publishes the 15 CVE records. They reach NVD between 22:16 and 23:17 ("Awaiting Analysis").
• 22 October: BSI publishes WID-SEC-2026-4112, revised on 23 October.
• 23 October, 02:05 to 23:52: CISA adds its assessments (exploitation "none") to 14 of the CVE records.
• 24 October, 17:20: The announcement is reposted to the oss-security mailing list.

Affected Product Versions

Per the ASF announcement, project advisory page and CVE records. The ASF announcement lists 9.x and 10.x; the 8.x ranges come from the CVE records.

Notes:

• Some flaws hit only the most recent builds. CVE-2026-111810 and CVE-2026-112381 affect only 9.2.15, 10.1.4 and 10.2.0. CVE-2026-111804 (wasm) affects only 10.x.
• CVE-2026-111817 has no 9.2.x fix. The ASF says trailer dropping (proxy.config.http.drop_chunked_trailers) "is on by default in 10.x. In 9.2.x it is off by default, and those versions are affected only if it is enabled," and that "no fix is included in 9.2.16." The fix ships in 10.1.5 and 10.2.1.
• Exposure is not compromise. Most of the highest-scored flaws need a plugin or setting that many deployments do not use.

Workaround and Mitigation

1. Upgrade. Move to 9.2.16, 10.1.5, 10.2.1 or later. The ASF offers no workaround in place of the upgrade.

2. Read the upgrade notes first. The fixes change behaviour, and some will refuse traffic or configuration that worked before (Upgrading to ATS v10.2; What's new in 10.2). Among the changes the project lists:

• magick "requires a signing key and allowlists the convert operators it will run. An existing configuration without a signing key will not load."
• tsmemcache "now binds only to the loopback address by default. It previously bound the wildcard address, which exposed the Traffic Server cache to every host able to reach the port."
• "A HEAD request carrying Content-Length or Transfer-Encoding is rejected." Setting proxy.config.http.reject_head_with_content to 0 restores the old behaviour.
• Reusing a pooled outbound session now "requires that its client certificate match the one the current transaction would present." The documentation warns this "increases the number of outbound handshakes" for deployments that configure a client certificate.
• Inbound TLS sessions are bound to the SNI and verify_client policy that issued them, and "sessions issued by a previous release may not resume after the upgrade and complete a full handshake instead."
• origin_server_auth "strips client-supplied x-amz- request headers that fall outside the scope its signature covers."

3. Check which plugins you actually run. Review plugin.config and remap.config for magick, wasm, tsmemcache and origin_server_auth (named s3_auth on 9.2.x). If you do not need an experimental plugin, remove it. Until you can upgrade:

• magick: unload it, or configure a signing key. Abraxas Labs reports that a request without a valid signature got a 403 when a key was configured.
• tsmemcache: make sure its port (11211 by default) is not reachable from untrusted networks. The project's Memcache plugin page warns it "exposes the shared Traffic Server cache with no authentication or access control."
• origin_server_auth and mTLS setups: the ASF documents no interim workaround, so prioritise these deployments for the upgrade. (Rescana guidance)

4. Look beyond your own servers. Traffic Server runs inside some CDN, edge and media-delivery platforms, often deep in their stack. Where a supplier delivers your content or APIs through such a platform, ask whether it uses Traffic Server and when it upgraded. (Rescana guidance)

Indicators of Compromise

The ASF, BSI and CISA have published no indicators of compromise, and no source we checked reports exploitation. None of the sources maps these flaws to MITRE ATT&CK, and we have not done so either. For the smuggling and cache-poisoning flaws, defenders can review access logs for HEAD requests carrying a body and for unexpected 302 responses served from cache. These are hunting ideas, not confirmed signs of attack. (Rescana guidance)

What we will update

We will update this post if CISA adds any of the 15 CVEs to the KEV catalog, if the ASF, CISA or a national CERT reports exploitation, if NVD publishes its own scores, if the ASF revises its advisory (for example with a 9.2.x fix for CVE-2026-111817), or if a public exploit is reported for a core-proxy flaw.

Sources

• Apache Traffic Server project (ASF): "[SECURITY] Multiple vulnerabilities fixed in Apache Traffic Server 9.2.16, 10.1.5 and 10.2.1" (20 October 2026): https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc; October 2026 CVE Release advisory: https://trafficserver.apache.org/security-2026-10.html; downloads: https://trafficserver.apache.org/downloads; Upgrading to ATS v10.2: https://docs.trafficserver.apache.org/en/10.2.x/release-notes/upgrading.en.html; What's new in 10.2: https://docs.trafficserver.apache.org/en/10.2.x/release-notes/whats-new.en.html; records.yaml reference: https://docs.trafficserver.apache.org/en/10.2.x/admin-guide/files/records.yaml.en.html; plugin index: https://docs.trafficserver.apache.org/en/10.2.x/admin-guide/plugins/index.en.html; Memcache plugin: https://docs.trafficserver.apache.org/en/10.2.x/admin-guide/plugins/memcache.en.html; release roadmap: https://docs.trafficserver.apache.org/en/latest/release-notes/roadmap.en.html
• CVE records (ASF as CNA): CVE-2026-111813, CVE-2026-111804, CVE-2026-111814, CVE-2026-111815, CVE-2026-111816, CVE-2025-31699, CVE-2025-55702, CVE-2026-111805, CVE-2026-111808, CVE-2026-111810, CVE-2026-111812, CVE-2026-111809, CVE-2026-111811, CVE-2026-112381, CVE-2026-111817
• NVD and CISA (US): NVD entry for CVE-2026-111813 (Awaiting Analysis; CISA assessment attached): https://nvd.nist.gov/vuln/detail/CVE-2026-111813; CISA Known Exploited Vulnerabilities catalog (checked 26 October 2026, 08:13 Cyprus time; catalog version 2026.10.23): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• BSI (Germany): WID-SEC-2026-4112, "Apache Traffic Server: Mehrere Schwachstellen" (22 October 2026, German): https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4112
• oss-security mailing list: repost of the ASF announcement (24 October 2026): https://www.openwall.com/lists/oss-security/2026/10/24/7
• Abraxas Labs: "ATS unsigned magick convert writes a file as nobody" (13 October 2026). Not linked because it points to proof-of-concept code.

A caching proxy decides what content and which identity reach the systems behind it, so a smuggling or certificate-reuse bug in one can affect many customers at once. Whether a supplier can quickly say if it runs Traffic Server, and which plugins and TLS settings it uses, is a good test of how well it knows its own edge.

Forward this to your TPRM owner: Send suppliers that deliver your content or APIs through a CDN, edge or caching layer a short, friendly check (Rescana guidance):

• Do you run Apache Traffic Server anywhere in your delivery stack, directly or through a platform you operate? If so, are you on 9.2.16, 10.1.5, 10.2.1 or later?
• Do you load any experimental plugins (magick, wasm, tsmemcache), or origin_server_auth (s3_auth on 9.2.x)? If so, how are they configured and exposed?
• Do you use client certificates (mTLS) towards origins or per-site client-certificate checks? Have you reviewed the session-reuse changes in the fixed releases?
• Are any systems still on the end-of-life 8.x line? What is your plan to move off it?

Want a fast, evidence-based view of how your suppliers handle edge infrastructure fixes like this one? Book a demo.