{
  "from_raw": "Masakazu Kitajo <maskit@apache.org>",
  "from": "Masakazu Kitajo <ma...@apache.org>",
  "gravatar": "8bd58b47230e31d8248582ae82b002be",
  "to": "an...@trafficserver.apache.org,\n users <us...@trafficserver.apache.org>",
  "subject": "[SECURITY] Multiple vulnerabilities fixed in Apache Traffic Server 9.2.16, 10.1.5 and 10.2.1",
  "message-id": "<CAGjw+kOPOn0+ydrmjgeDm-Bnhx9OBCyyVVk3EfojnBBB_0q2pA@mail.gmail.com>",
  "mid": "9yl26n1gookyf19flxs2lbg3x808l883",
  "permalinks": [
    "9yl26n1gookyf19flxs2lbg3x808l883",
    "rb6b0788fb76aaa6839b0db9b8be221bde049bc8f919b5fc521fcdf56@<users.trafficserver.apache.org>"
  ],
  "dbid": "93ad58e2bb28b3457d6d1795f08e7eec4d919ca640079f8d6f1d07b0f019de8b",
  "cc": "",
  "epoch": 1792548454,
  "list": "<users.trafficserver.apache.org>",
  "list_raw": "<users.trafficserver.apache.org>",
  "date": "2026/10/21 02:07:34",
  "private": false,
  "references": "",
  "in-reply-to": "",
  "body": "The following 15 vulnerabilities affecting Apache Traffic Server have been\nfixed in versions 9.2.16, 10.1.5 and 10.2.1:\n\n============================================================\n\nThe Apache Traffic Server experimental magick plugin lets an\nunauthenticated client control ImageMagick convert arguments in its default\n(unsigned) configuration.\n\nCVE:\nCVE-2026-111813 - magick plugin passes client query strings unfiltered to\nImageMagick convert in the default configuration\n\nSeverity:\ncritical\nCVSS v3.1: 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\nCVSS v4.0: 10.0\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\n\nReported By:\nApache Community\nAbraxas Labs\nThe ASF\n\nVendor:\nThe ASF\n\nVersion Affected:\nATS 9.0.0 to 9.2.15\nATS 10.0.0 to 10.1.4\nATS 10.2.0\n\nMitigation:\n9.x users should upgrade to 9.2.16 or later versions\n10.1.x users should upgrade to 10.1.5 or later versions\n10.2.x users should upgrade to 10.2.1 or later versions\n\nReference:\nhttps://www.cve.org/CVERecord?id=CVE-2026-111813\n\n============================================================\n\nThe Apache Traffic Server experimental wasm plugin has a use-after-free in\nits transaction-close handler and forwards unvalidated guest-supplied\nmetric IDs to the internal stats API.\n\nCVE:\nCVE-2026-111804 - wasm plugin has a use-after-free and forwards unvalidated\nguest metric IDs\n\nSeverity:\ncritical\nCVSS v3.1: 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H\nCVSS v4.0: 8.8\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N\n\nReported By:\nOmkhar Arasaratnam\nApache Community\n\nVendor:\nThe ASF\n\nVersion Affected:\nATS 10.0.0 to 10.1.4\nATS 10.2.0\n\nMitigation:\n10.1.x users should upgrade to 10.1.5 or later versions\n10.2.x users should upgrade to 10.2.1 or later versions\n\nReference:\nhttps://www.cve.org/CVERecord?id=CVE-2026-111804\n\n============================================================\n\nApache Traffic Server can return an origin connection to the shared pool\nwhile the origin is still waiting on a request body the client declared but\nnever fully sent, including when the client used Expect: 100-continue. The\norigin then reads a later request on that connection as leftover body data,\nwhich lets an attacker smuggle requests past ATS access controls, disrupt\nother users' requests, or poison the cache.\n\nCVE:\nCVE-2025-31699 - Origin connection still owed a request body is reused,\nenabling request smuggling\n\nSeverity:\nimportant\nCVSS v3.1: 8.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L\nCVSS v4.0: 9.1\nCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:H/SI:H/SA:L\n\nReported By:\nMartin van Kervel Smedshammer\nNick Muerdter\n\nVendor:\nThe ASF\n\nVersion Affected:\nATS 9.0.0 to 9.2.15\nATS 10.0.0 to 10.1.4\nATS 10.2.0\n\nMitigation:\n9.x users should upgrade to 9.2.16 or later versions\n10.1.x users should upgrade to 10.1.5 or later versions\n10.2.x users should upgrade to 10.2.1 or later versions\n\nReference:\nhttps://www.cve.org/CVERecord?id=CVE-2025-31699\n\n============================================================\n\nWhen a client sends a POST with Expect: 100-continue and the origin answers\nbefore reading the body, Apache Traffic Server parses the unread body left\non the client connection as the next request. An attacker behind a\nfront-end proxy that shares connections to Traffic Server can use this to\nsmuggle requests past the front end and desynchronize responses for other\nusers.\n\nCVE:\nCVE-2025-55702 - An unread Expect: 100-continue request body is framed as a\nnew request\n\nSeverity:\nimportant\nCVSS v3.1: 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N\nCVSS v4.0: 7.0\nCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N\n\nReported By:\nSebastiano Sartor\n\nVendor:\nThe ASF\n\nVersion Affected:\nATS 9.0.0 to 9.2.15\nATS 10.0.0 to 10.1.4\nATS 10.2.0\n\nMitigation:\n9.x users should upgrade to 9.2.16 or later versions\n10.1.x users should upgrade to 10.1.5 or later versions\n10.2.x users should upgrade to 10.2.1 or later versions\n\nReference:\nhttps://www.cve.org/CVERecord?id=CVE-2025-55702\n\n============================================================\n\nApache Traffic Server forwarded a malformed 302 response that should have\nbeen rejected as a parse error, because the Transfer-Encoding: chunked\ncarve-out bypassed the rejection path. A response that two peers can read\ndifferently is then stored and served, allowing cache poisoning and\nresponse-framing desync.\n\nCVE:\nCVE-2026-111816 - A malformed 302 response bypasses parse-error rejection\nthrough the Transfer-Encoding: chunked carve-out\n\nSeverity:\nimportant\nCVSS v3.1: 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N\nCVSS v4.0: 9.2\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N\n\nReported By:\nApache Community\nOneZ3r0\n\nVendor:\nThe ASF\n\nVersion Affected:\nATS 9.0.0 to 9.2.15\nATS 10.0.0 to 10.1.4\nATS 10.2.0\n\nMitigation:\n9.x users should upgrade to 9.2.16 or later versions\n10.1.x users should upgrade to 10.1.5 or later versions\n10.2.x users should upgrade to 10.2.1 or later versions\n\nReference:\nhttps://www.cve.org/CVERecord?id=CVE-2026-111816\n\n============================================================\n\nApache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker\npool via a truncated HTTP/2 Content-Length value.\n\nCVE:\nCVE-2026-111805 - HTTP/2 Content-Length truncation lets a client trigger\nbackend worker-pool exhaustion\n\nSeverity:\nimportant\nCVSS v3.1: 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H\nCVSS v4.0: 7.7\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H\n\nReported By:\nmatrix_cain (YakLang)\nAlieldeen Khaled Ali\nJesse Yang\nAlex Williams (Pellera Technologies)\nVulnCheck (coordinator)\nThe ASF\n\nVendor:\nThe ASF\n\nVersion Affected:\nATS 9.0.0 to 9.2.15\nATS 10.0.0 to 10.1.4\nATS 10.2.0\n\nMitigation:\n9.x users should upgrade to 9.2.16 or later versions\n10.1.x users should upgrade to 10.1.5 or later versions\n10.2.x users should upgrade to 10.2.1 or later versions\n\nReference:\nhttps://www.cve.org/CVERecord?id=CVE-2026-111805\n\n============================================================\n\nApache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker\npool via a malformed padded HTTP/2 DATA frame.\n\nCVE:\nCVE-2026-111808 - HTTP/2 DATA frame padding underflow lets a client trigger\nbackend worker-pool exhaustion\n\nSeverity:\nimportant\nCVSS v3.1: 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H\nCVSS v4.0: 7.7\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H\n\nReported By:\nKhalilov Moe (LeetProtect)\nThe ASF\n\nVendor:\nThe ASF\n\nVersion Affected:\nATS 9.0.0 to 9.2.15\nATS 10.0.0 to 10.1.4\nATS 10.2.0\n\nMitigation:\n9.x users should upgrade to 9.2.16 or later versions\n10.1.x users should upgrade to 10.1.5 or later versions\n10.2.x users should upgrade to 10.2.1 or later versions\n\nReference:\nhttps://www.cve.org/CVERecord?id=CVE-2026-111808\n\n============================================================\n\nApache Traffic Server's default outbound session-sharing policy can reuse a\npooled TLS session authenticated with one client certificate for a\ntransaction configured to present a different one.\n\nCVE:\nCVE-2026-111814 - Default server_session_sharing.match omits MASK_CERT,\nallowing pooled mTLS identity confusion at the origin\n\nSeverity:\nimportant\nCVSS v3.1: 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N\nCVSS v4.0: 7.8\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N\n\nReported By:\nCraig Taylor\n\nVendor:\nThe ASF\n\nVersion Affected:\nATS 9.0.0 to 9.2.15\nATS 10.0.0 to 10.1.4\nATS 10.2.0\n\nMitigation:\n9.x users should upgrade to 9.2.16 or later versions\n10.1.x users should upgrade to 10.1.5 or later versions\n10.2.x users should upgrade to 10.2.1 or later versions\n\nReference:\nhttps://www.cve.org/CVERecord?id=CVE-2026-111814\n\n============================================================\n\nApache Traffic Server can resume a TLS session across SNI virtual hosts\nwithout re-verifying a client certificate required by the resumed host's\nverify_client STRICT policy.\n\nCVE:\nCVE-2026-111815 - TLS session ticket resumption bypasses per-SNI\nverify_client STRICT enforcement\n\nSeverity:\nimportant\nCVSS v3.1: 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N\nCVSS v4.0: 7.8\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N\n\nReported By:\nYonghwa Lee, Xint by Theori\n\nVendor:\nThe ASF\n\nVersion Affected:\nATS 9.0.0 to 9.2.15\nATS 10.0.0 to 10.1.4\nATS 10.2.0\n\nMitigation:\n9.x users should upgrade to 9.2.16 or later versions\n10.1.x users should upgrade to 10.1.5 or later versions\n10.2.x users should upgrade to 10.2.1 or later versions\n\nReference:\nhttps://www.cve.org/CVERecord?id=CVE-2026-111815\n\n============================================================\n\nApache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled\ndiagnostic log line for every internal @ header they strip, so a request\ncarrying many such headers makes the proxy write far more log data than the\nrequest contains.\n\nCVE:\nCVE-2026-111810 - Unthrottled per-header diagnostic logging enables a\nlog-flood denial of service\n\nSeverity:\nimportant\nCVSS v3.1: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\nCVSS v4.0: 8.7\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\n\nReported By:\nApache Community\n\nVendor:\nThe ASF\n\nVersion Affected:\nATS 9.2.15\nATS 10.1.4\nATS 10.2.0\n\nMitigation:\n9.x users should upgrade to 9.2.16 or later versions\n10.1.x users should upgrade to 10.1.5 or later versions\n10.2.x users should upgrade to 10.2.1 or later versions\n\nReference:\nhttps://www.cve.org/CVERecord?id=CVE-2026-111810\n\n============================================================\n\nApache Traffic Server allows request smuggling via HEAD requests that carry\nContent-Length or Transfer-Encoding.\n\nCVE:\nCVE-2026-111809 - HEAD requests carrying Content-Length or\nTransfer-Encoding enable request smuggling\n\nSeverity:\nmoderate\nCVSS v3.1: 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N\nCVSS v4.0: 6.9\nCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N\n\nReported By:\nApache Community\n\nVendor:\nThe ASF\n\nVersion Affected:\nATS 9.0.0 to 9.2.15\nATS 10.0.0 to 10.1.4\nATS 10.2.0\n\nMitigation:\n9.x users should upgrade to 9.2.16 or later versions\n10.1.x users should upgrade to 10.1.5 or later versions\n10.2.x users should upgrade to 10.2.1 or later versions\n\nReference:\nhttps://www.cve.org/CVERecord?id=CVE-2026-111809\n\n============================================================\n\nThe Apache Traffic Server experimental tsmemcache plugin allows\nunauthenticated network read, write, and deletion of the shared proxy cache.\n\nCVE:\nCVE-2026-111811 - tsmemcache plugin exposes the shared proxy cache over the\nnetwork with no authentication\n\nSeverity:\nmoderate\nCVSS v3.1: 9.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\nCVSS v4.0: 9.4\nCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H\n\nReported By:\nApache Community\n\nVendor:\nThe ASF\n\nVersion Affected:\nATS 9.0.0 to 9.2.15\nATS 10.0.0 to 10.1.4\nATS 10.2.0\n\nMitigation:\n9.x users should upgrade to 9.2.16 or later versions\n10.1.x users should upgrade to 10.1.5 or later versions\n10.2.x users should upgrade to 10.2.1 or later versions\n\nReference:\nhttps://www.cve.org/CVERecord?id=CVE-2026-111811\n\n============================================================\n\nThe Apache Traffic Server origin_server_auth plugin lets a client force\nsigning of attacker-chosen AWS request headers under the proxy's own\ncredentials.\n\nCVE:\nCVE-2026-111812 - origin_server_auth signs client-controlled AWS headers\nunder the proxy's IAM credentials\n\nSeverity:\nmoderate\nCVSS v3.1: 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N\nCVSS v4.0: 7.0\nCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N\n\nReported By:\nApache Community\n\nVendor:\nThe ASF\n\nVersion Affected:\nATS 9.0.0 to 9.2.15\nATS 10.0.0 to 10.1.4\nATS 10.2.0\n\nMitigation:\n9.x users should upgrade to 9.2.16 or later versions\n10.1.x users should upgrade to 10.1.5 or later versions\n10.2.x users should upgrade to 10.2.1 or later versions\n\nReference:\nhttps://www.cve.org/CVERecord?id=CVE-2026-111812\n\n============================================================\n\nApache Traffic Server can stall a chunked transfer that it passes through\nwith its trailers removed (proxy.config.http.drop_chunked_trailers) until\nthe connection times out, because it waits for the trailer bytes it has\nalready dropped. Trailer dropping is on by default in 10.x. In 9.2.x it is\noff by default, and those versions are affected only if it is enabled.\n\nCVE:\nCVE-2026-111817 - Dropping chunked trailers stalls a passthrough transfer\nuntil timeout\n\nSeverity:\nmoderate\nCVSS v3.1: 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\nCVSS v4.0: 6.9\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N\n\nReported By:\nOmkhar Arasaratnam\n\nVendor:\nThe ASF\n\nVersion Affected:\nATS 9.2.5 to 9.2.15\nATS 10.0.0 to 10.1.4\nATS 10.2.0\n\nMitigation:\n9.x: no fix is included in 9.2.16; affected only if drop_chunked_trailers\nis enabled\n10.1.x users should upgrade to 10.1.5 or later versions\n10.2.x users should upgrade to 10.2.1 or later versions\n\nReference:\nhttps://www.cve.org/CVERecord?id=CVE-2026-111817\n\n============================================================\n\nApache Traffic Server can crash with a null pointer dereference when a\nclient POST request is torn down via half-close while a chunked origin\nresponse is being reparsed from a reentrant write-ready callback, a\ntiming-dependent race.\n\nCVE:\nCVE-2026-112381 - Nullptr dereference in net_write_io on a POST half-close\nwith chunked response\n\nSeverity:\nmoderate\nCVSS v3.1: 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\nCVSS v4.0: 8.2\nCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\n\nReported By:\nMasaori Koshiba\n\nVendor:\nThe ASF\n\nVersion Affected:\nATS 9.2.15\nATS 10.1.4\nATS 10.2.0\n\nMitigation:\n9.x users should upgrade to 9.2.16 or later versions\n10.1.x users should upgrade to 10.1.5 or later versions\n10.2.x users should upgrade to 10.2.1 or later versions\n\nReference:\nhttps://www.cve.org/CVERecord?id=CVE-2026-112381\n\n============================================================\n\nUsers of all affected versions should upgrade to 9.2.16, 10.1.5 or 10.2.1\nas soon as possible.\n\nWe would like to thank all reporters credited above, and the Apache\nTraffic Server community, for identifying and helping resolve these\nissues.\n\nRegards,\nMasakazu Kitajo\nApache Traffic Server PMC\n",
  "body_short": "The following 15 vulnerabilities affecting Apache Traffic Server have been\nfixed in versions 9.2.16, 10.1.5 and 10.2.1:\n\n============================================================\n\nThe Apache Traffic",
  "html_source_only": false,
  "attachments": [],
  "forum": "users@trafficserver.apache.org",
  "size": 37976,
  "id": "9yl26n1gookyf19flxs2lbg3x808l883"
}