You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@trafficserver.apache.org by bc...@apache.org on 2026/10/21 03:29:57 UTC
(trafficserver-site) branch asf-site updated: Add the October 2026 CVE release advisory
This is an automated email from the ASF dual-hosted git repository.
bryancall pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/trafficserver-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new f60ec88 Add the October 2026 CVE release advisory
f60ec88 is described below
commit f60ec88b9c279ad0348c683e9591d2f68a252b0c
Author: Bryan Call <bc...@apache.org>
AuthorDate: Tue Oct 20 20:17:55 2026 -0700
Add the October 2026 CVE release advisory
security-2026-10.html lists the 15 CVEs fixed in 9.2.16, 10.1.5 and
10.2.1, as announced on announce@trafficserver.apache.org on
2026-10-20. The home page banner now points to it instead of the July
2026 advisory, and the 10.2.1 / 10.1.5 news item links to it.
---
content/index.html | 8 +-
content/security-2026-10.html | 345 +++++++++++++++++++++++++++++++++++
source/templates/index.template.html | 6 +-
source/versions.json | 2 +-
4 files changed, 353 insertions(+), 8 deletions(-)
diff --git a/content/index.html b/content/index.html
index d5335f6..f5af391 100644
--- a/content/index.html
+++ b/content/index.html
@@ -82,7 +82,7 @@ To update:
<!-- HOT TOPIC BANNER - current security release -->
<!-- Update the text/link here when the featured topic changes. -->
<!-- ============================================================ -->
- <a href="security-2026-07.html" class="block" style="background:linear-gradient(135deg,#d97706 0%,#b45309 100%);border-top:3px solid #78350f;box-shadow:0 4px 16px rgba(180,83,9,.4);text-decoration:none;" aria-label="July 2026 CVE release security advisory">
+ <a href="security-2026-10.html" class="block" style="background:linear-gradient(135deg,#d97706 0%,#b45309 100%);border-top:3px solid #78350f;box-shadow:0 4px 16px rgba(180,83,9,.4);text-decoration:none;" aria-label="October 2026 CVE release security advisory">
<div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8" style="padding-top:.9rem;padding-bottom:.9rem;">
<div class="flex flex-col sm:flex-row items-center justify-between gap-4">
<div class="flex items-center gap-4">
@@ -91,8 +91,8 @@ To update:
</svg>
<span class="flex-shrink-0" style="display:inline-block;background:#1e3a8a;color:#fff;font-size:.85rem;font-weight:800;letter-spacing:.1em;padding:.4rem .9rem;border-radius:9999px;white-space:nowrap;box-shadow:0 1px 3px rgba(0,0,0,.25);">SECURITY RELEASE</span>
<div style="color:#fff;line-height:1.35;text-shadow:0 1px 2px rgba(0,0,0,.28);">
- <div style="font-size:1.2rem;font-weight:700;letter-spacing:.01em;">July 2026 CVE Release</div>
- <div style="font-size:1.02rem;opacity:.95;"><strong>34</strong> vulnerabilities fixed in Apache Traffic Server 9.2.14 & 10.1.3. Upgrading is strongly recommended.</div>
+ <div style="font-size:1.2rem;font-weight:700;letter-spacing:.01em;">October 2026 CVE Release</div>
+ <div style="font-size:1.02rem;opacity:.95;"><strong>15</strong> vulnerabilities fixed in Apache Traffic Server 9.2.16, 10.1.5 & 10.2.1. Upgrading is strongly recommended.</div>
</div>
</div>
<span class="ats-alert-cta" style="display:inline-block;background:#fff;color:#b45309;font-weight:700;font-size:.98rem;letter-spacing:.01em;padding:.65rem 1.35rem;border-radius:.5rem;white-space:nowrap;box-shadow:0 3px 12px rgba(0,0,0,.2);">Read the advisory →</span>
@@ -333,7 +333,7 @@ To update:
<div class="space-y-6">
<div class="border-l-4 border-accent pl-6 py-2">
<p class="text-sm text-secondary font-semibold mb-1">October 20, 2026</p>
- <p class="text-gray-700">Apache Traffic Server <strong>v10.2.1</strong> and <strong>v10.1.5</strong> security release.</p>
+ <p class="text-gray-700">Apache Traffic Server <strong>v10.2.1</strong> and <strong>v10.1.5</strong> security release. Read the <a href="security-2026-10.html" class="text-accent underline">October 2026 CVE release advisory</a>.</p>
</div>
<div class="border-l-4 border-accent pl-6 py-2">
<p class="text-sm text-secondary font-semibold mb-1">October 20, 2026</p>
diff --git a/content/security-2026-10.html b/content/security-2026-10.html
new file mode 100644
index 0000000..f81e5d5
--- /dev/null
+++ b/content/security-2026-10.html
@@ -0,0 +1,345 @@
+<!DOCTYPE html>
+<!--
+============================================================
+APACHE TRAFFIC SERVER - SECURITY ADVISORY (October 2026)
+============================================================
+AUTO-GENERATED from the release CVE map by gen_advisory_page.py.
+Do not edit this file directly; edit the CVE map and regenerate.
+============================================================
+-->
+<html lang="en">
+<head>
+ <meta charset="UTF-8">
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
+ <title>Security Advisory - October 2026 CVE Release | Apache Traffic Server</title>
+
+ <link rel="stylesheet" href="styles/tailwind-complete.css">
+ <link rel="stylesheet" href="styles/custom.css">
+ <style>
+ .adv-hero { background: linear-gradient(135deg, #1e3a8a 0%, #0e7490 100%); }
+ .adv-badge { display:inline-block; font-size:.7rem; font-weight:700; letter-spacing:.06em;
+ text-transform:uppercase; padding:.2rem .6rem; border-radius:9999px;
+ background:rgba(255,255,255,.15); color:#fff; border:1px solid rgba(255,255,255,.3); }
+ .adv-stat { background:linear-gradient(135deg,rgba(255,255,255,.16) 0%,rgba(255,255,255,.05) 100%); border:1px solid rgba(255,255,255,.25);
+ border-radius:.75rem; padding:1rem 1.25rem; }
+ .adv-stat .n { font-size:1.75rem; font-weight:700; line-height:1; }
+ .adv-stat .n-versions { font-size:1.2rem; line-height:1.3; }
+ .adv-stat .l { font-size:.8rem; color:#dbeafe; margin-top:.25rem; }
+ .adv-note { background:#eff6ff; border:1px solid #bfdbfe; border-left:4px solid #3b82f6;
+ border-radius:.5rem; padding:1rem 1.25rem; color:#1e3a8a; }
+ .adv-legend { font-size:.9rem; color:#475569; margin:0 0 1.75rem; padding:.75rem 1rem;
+ background:#f8fafc; border:1px solid #e2e8f0; border-radius:.5rem; line-height:1.6; }
+ .adv-legend strong { color:#1e293b; }
+ .type-dist { display:flex; flex-wrap:wrap; gap:.4rem; align-items:center; margin:0 0 1.75rem; }
+ .type-dist .lbl { font-size:.9rem; color:#475569; font-weight:700; margin-right:.15rem; }
+ .dist-chip { display:inline-block; font-size:.8rem; color:#334155; background:#f1f5f9;
+ border:1px solid #cbd5e1; border-radius:9999px; padding:.2rem .6rem; }
+ .dist-chip strong { color:#1e293b; }
+ .sev-head { display:flex; align-items:center; gap:.75rem; margin:2.5rem 0 1rem; }
+ .sev-dot { width:.9rem; height:.9rem; border-radius:9999px; }
+ .sev-head h2 { font-size:1.5rem; font-weight:700; color:#1e3a8a; margin:0; }
+ .sev-head .count { color:#64748b; font-weight:600; font-size:1rem; }
+ .cve-card { background:#fff; border:1px solid #e5e7eb; border-left:4px solid #64748b;
+ border-radius:.75rem; padding:1.25rem 1.5rem; box-shadow:0 1px 2px rgba(0,0,0,.05);
+ transition:box-shadow .2s ease, transform .2s ease; }
+ .cve-card:hover { box-shadow:0 8px 20px rgba(0,0,0,.08); transform:translateY(-2px); }
+ .cve-top { display:flex; flex-wrap:wrap; align-items:center; gap:.5rem; margin-bottom:.5rem; }
+ .cve-id { font-family:ui-monospace,SFMono-Regular,Menlo,monospace; font-weight:700;
+ font-size:.95rem; color:#1e3a8a; }
+ .cve-id a { color:#1e3a8a; text-decoration:none; }
+ .cve-id a:hover { text-decoration:underline; }
+ .pending { font-family:inherit; font-weight:600; font-size:.72rem; text-transform:uppercase;
+ letter-spacing:.05em; color:#92400e; background:#fef3c7; border:1px solid #fde68a;
+ border-radius:9999px; padding:.15rem .55rem; }
+ .pill { font-size:.72rem; font-weight:700; text-transform:uppercase; letter-spacing:.04em;
+ padding:.15rem .55rem; border-radius:9999px; }
+ .pill-important { color:#fff; background:linear-gradient(135deg,#dc2626 0%,#991b1b 100%); border:none; text-shadow:0 1px 1px rgba(0,0,0,.2); }
+ .pill-moderate { color:#78350f; background:linear-gradient(135deg,#fde68a 0%,#fbbf24 100%); border:1px solid #fcd34d; }
+ .pill-critical { color:#fff; background:linear-gradient(135deg,#ef4444 0%,#7f1d1d 100%); border:none; text-shadow:0 1px 1px rgba(0,0,0,.25); }
+ .pill-low { color:#fff; background:linear-gradient(135deg,#94a3b8 0%,#475569 100%); border:none; }
+ .cvss { font-family:ui-monospace,SFMono-Regular,Menlo,monospace; font-size:.72rem;
+ font-weight:600; color:#3730a3; background:#eef2ff; border:1px solid #c7d2fe;
+ border-radius:9999px; padding:.15rem .55rem; }
+ .cve-title { font-size:1.05rem; font-weight:600; color:#111827; margin:.15rem 0 .35rem; }
+ .cve-desc { color:#374151; line-height:1.6; margin:0 0 .75rem; }
+ .cve-meta { display:flex; flex-wrap:wrap; gap:.35rem 1.5rem; margin:0; font-size:.85rem; }
+ .cve-meta div { display:flex; gap:.4rem; }
+ .cve-meta dt { color:#64748b; font-weight:600; margin:0; }
+ .cve-meta dd { color:#374151; margin:0; }
+ .cve-meta dd.type-dd { display:flex; flex-wrap:wrap; gap:.3rem; }
+ .type-tag { display:inline-block; font-size:.72rem; font-weight:600; color:#334155;
+ background:#f1f5f9; border:1px solid #cbd5e1; border-radius:9999px; padding:.05rem .55rem; }
+ </style>
+</head>
+<body class="font-sans text-gray-800 bg-white">
+ <header class="sticky top-0 z-50 bg-white shadow-sm">
+ <div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8">
+ <div class="flex justify-between items-center py-4">
+ <div class="flex items-center">
+ <a href="index.html" class="flex items-center space-x-3">
+ <img src="images/press/ts_logo_tm_380x73.png" alt="Apache Traffic Server" class="h-12 w-auto">
+ </a>
+ </div>
+
+ <nav class="hidden lg:flex items-center space-x-6">
+ <a href="index.html" class="text-gray-700 hover:text-accent transition-colors font-medium">Home</a>
+ <a href="downloads.html" class="text-gray-700 hover:text-accent transition-colors font-medium">Downloads</a>
+ <a href="https://docs.trafficserver.apache.org/en/latest/index.html" class="text-gray-700 hover:text-accent transition-colors font-medium">Documentation</a>
+ <a href="https://github.com/apache/trafficserver" class="text-gray-700 hover:text-accent transition-colors font-medium">GitHub</a>
+ <a href="https://github.com/apache/trafficserver/issues" class="text-gray-700 hover:text-accent transition-colors font-medium">Issues</a>
+ <a href="https://ci.trafficserver.apache.org/" class="text-gray-700 hover:text-accent transition-colors font-medium">CI</a>
+ <a href="users.html" class="text-gray-700 hover:text-accent transition-colors font-medium">Customers</a>
+ </nav>
+
+ <div class="hidden lg:flex items-center space-x-4">
+ <a href="https://www.apache.org/" class="flex items-center">
+ <img src="https://www.apache.org/images/feather-small.png" alt="The Apache Software Foundation" class="h-10 w-auto">
+ </a>
+ </div>
+
+ <button id="mobile-menu-button" class="lg:hidden p-2 rounded-md text-gray-700 hover:text-accent hover:bg-gray-100 focus:outline-none focus:ring-2 focus:ring-accent" aria-label="Toggle menu">
+ <svg class="h-6 w-6" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+ <path id="menu-icon" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 6h16M4 12h16M4 18h16"/>
+ <path id="close-icon" class="hidden" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12"/>
+ </svg>
+ </button>
+ </div>
+
+ <nav id="mobile-menu" class="hidden lg:hidden pb-4 mobile-menu-enter">
+ <div class="space-y-2">
+ <a href="index.html" class="block px-3 py-2 rounded-md text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors font-medium">Home</a>
+ <a href="downloads.html" class="block px-3 py-2 rounded-md text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors font-medium">Downloads</a>
+ <a href="https://docs.trafficserver.apache.org/en/latest/index.html" class="block px-3 py-2 rounded-md text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors font-medium">Documentation</a>
+ <a href="https://github.com/apache/trafficserver" class="block px-3 py-2 rounded-md text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors font-medium">GitHub</a>
+ <a href="https://github.com/apache/trafficserver/issues" class="block px-3 py-2 rounded-md text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors font-medium">Issues</a>
+ <a href="https://ci.trafficserver.apache.org/" class="block px-3 py-2 rounded-md text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors font-medium">CI</a>
+ <a href="users.html" class="block px-3 py-2 rounded-md text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors font-medium">Customers</a>
+ <a href="acknowledgements.html" class="block px-3 py-2 rounded-md text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors font-medium">Acknowledgements</a>
+ <a href="press.html" class="block px-3 py-2 rounded-md text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors font-medium">Press Kit</a>
+ </div>
+ </nav>
+ </div>
+ </header>
+
+ <section class="adv-hero text-white py-16">
+ <div class="max-w-5xl mx-auto px-4 sm:px-6 lg:px-8">
+ <span class="adv-badge">Security Release</span>
+ <h1 class="text-4xl md:text-5xl font-bold leading-tight mt-4 mb-4">
+ October 2026 CVE Release
+ </h1>
+ <p class="text-lg text-blue-100 mb-8 leading-relaxed max-w-3xl">
+ Apache Traffic Server <strong>9.2.16</strong>, <strong>10.1.5</strong> and <strong>10.2.1</strong> fix the
+ 15 security vulnerabilities listed below. They affect releases up to and
+ including <strong>9.2.15</strong>, <strong>10.1.4</strong> and <strong>10.2.0</strong> — among them
+ request-smuggling, memory-safety, and access-control issues, the most serious
+ rated <strong>CVSS 10.0</strong>. Fixed releases are available now,
+ and all users are strongly encouraged to upgrade promptly.
+ </p>
+ <div class="grid grid-cols-2 lg:grid-cols-5 gap-4 max-w-4xl">
+ <div class="adv-stat"><div class="n">15</div><div class="l">Total CVEs</div></div>
+ <div class="adv-stat"><div class="n">2</div><div class="l">Critical</div></div>
+ <div class="adv-stat"><div class="n">8</div><div class="l">Important</div></div>
+ <div class="adv-stat"><div class="n">5</div><div class="l">Moderate</div></div>
+ <div class="adv-stat"><div class="n n-versions">9.2.16<br>10.1.5<br>10.2.1</div><div class="l">Fixed versions</div></div>
+ </div>
+ <div class="mt-8">
+ <a href="downloads.html" class="btn-gradient inline-block px-6 py-3 rounded-lg font-semibold text-white">
+ Download the fixed releases
+ </a>
+ </div>
+ </div>
+ </section>
+
+ <section class="py-12 bg-white">
+ <div class="max-w-5xl mx-auto px-4 sm:px-6 lg:px-8">
+ <div class="adv-note" style="margin-bottom:2rem">
+ These vulnerabilities were identified through the Apache Traffic Server security
+ process and reports from external researchers. We thank all reporters,
+ credited per advisory below. To report a security issue, email
+ <a href="mailto:security@trafficserver.apache.org" class="text-accent underline">security@trafficserver.apache.org</a>;
+ please do not open public issues for security matters. See also the
+ <a href="https://www.apache.org/security/" class="text-accent underline">ASF security policy</a>.
+ The previous advisory, the <a href="security-2026-07.html" class="text-accent underline">July 2026 CVE release</a>
+ (fixed in 9.2.15 and 10.1.4), remains available.
+ </div>
+ <div class="type-dist">
+ <span class="lbl">By type:</span>
+ <span class="dist-chip"><strong>5</strong> Denial of service</span><span class="dist-chip"><strong>4</strong> Request smuggling</span><span class="dist-chip"><strong>3</strong> Access-control bypass</span><span class="dist-chip"><strong>1</strong> Argument injection</span><span class="dist-chip"><strong>1</strong> Memory safety</span><span class="dist-chip"><strong>1</strong> Spoofing / cert trust</span>
+ </div>
+ <p class="adv-legend">
+ <strong>How to read this:</strong> <strong>Severity</strong> is the Apache rating — the impact and exploitability of the issue in a default configuration. <strong>CVSS</strong> is the technical base score, which can be higher for issues that need specific conditions or a non-default configuration to reach.
+ </p>
+ <div class="sev-head">
+ <span class="sev-dot" style="background:#7f1d1d"></span>
+ <h2>Critical</h2>
+ <span class="count">2 advisories</span>
+ </div>
+ <div class="space-y-4">
+ <article class="cve-card" style="border-left-color:#7f1d1d">
+ <div class="cve-top"><span class="cve-id"><a href="https://www.cve.org/CVERecord?id=CVE-2026-111813" target="_blank" rel="noopener">CVE-2026-111813</a></span><span class="pill pill-critical">Critical</span><span class="cvss">CVSS 10</span></div>
+ <h3 class="cve-title">magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration</h3>
+ <p class="cve-desc">Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin: magick</dd></div><div><dt>Type</dt><dd class="type-dd"><span class="type-tag">Argument injection</span></dd></div><div><dt>Fixed in</dt><dd>9.2.16 / 10.1.5 / 10.2.1</dd></div><div><dt>Reported by</dt><dd>Apache Community, The ASF, Abraxas Labs</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#7f1d1d">
+ <div class="cve-top"><span class="cve-id"><a href="https://www.cve.org/CVERecord?id=CVE-2026-111804" target="_blank" rel="noopener">CVE-2026-111804</a></span><span class="pill pill-critical">Critical</span><span class="cvss">CVSS 8.2</span></div>
+ <h3 class="cve-title">wasm plugin has a use-after-free and forwards unvalidated guest metric IDs</h3>
+ <p class="cve-desc">Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin: wasm</dd></div><div><dt>Type</dt><dd class="type-dd"><span class="type-tag">Memory safety</span></dd></div><div><dt>Fixed in</dt><dd>10.1.5 / 10.2.1</dd></div><div><dt>Reported by</dt><dd>Omkhar Arasaratnam, Apache Community</dd></div></dl>
+ </article>
+ </div>
+ <div class="sev-head">
+ <span class="sev-dot" style="background:#dc2626"></span>
+ <h2>Important</h2>
+ <span class="count">8 advisories</span>
+ </div>
+ <div class="space-y-4">
+ <article class="cve-card" style="border-left-color:#dc2626">
+ <div class="cve-top"><span class="cve-id"><a href="https://www.cve.org/CVERecord?id=CVE-2026-111814" target="_blank" rel="noopener">CVE-2026-111814</a></span><span class="pill pill-important">Important</span><span class="cvss">CVSS 10</span></div>
+ <h3 class="cve-title">Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin</h3>
+ <p class="cve-desc">Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>TLS / origin session sharing</dd></div><div><dt>Type</dt><dd class="type-dd"><span class="type-tag">Spoofing / cert trust</span></dd></div><div><dt>Fixed in</dt><dd>9.2.16 / 10.1.5 / 10.2.1</dd></div><div><dt>Reported by</dt><dd>Craig Taylor</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#dc2626">
+ <div class="cve-top"><span class="cve-id"><a href="https://www.cve.org/CVERecord?id=CVE-2026-111815" target="_blank" rel="noopener">CVE-2026-111815</a></span><span class="pill pill-important">Important</span><span class="cvss">CVSS 10</span></div>
+ <h3 class="cve-title">TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement</h3>
+ <p class="cve-desc">Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>TLS/SNI</dd></div><div><dt>Type</dt><dd class="type-dd"><span class="type-tag">Access-control bypass</span></dd></div><div><dt>Fixed in</dt><dd>9.2.16 / 10.1.5 / 10.2.1</dd></div><div><dt>Reported by</dt><dd>Yonghwa Lee, Xint by Theori</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#dc2626">
+ <div class="cve-top"><span class="cve-id"><a href="https://www.cve.org/CVERecord?id=CVE-2026-111816" target="_blank" rel="noopener">CVE-2026-111816</a></span><span class="pill pill-important">Important</span><span class="cvss">CVSS 9.3</span></div>
+ <h3 class="cve-title">A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out</h3>
+ <p class="cve-desc">Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-framing desync.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>HTTP/1 response parsing</dd></div><div><dt>Type</dt><dd class="type-dd"><span class="type-tag">Request smuggling</span></dd></div><div><dt>Fixed in</dt><dd>9.2.16 / 10.1.5 / 10.2.1</dd></div><div><dt>Reported by</dt><dd>Apache Community, OneZ3r0</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#dc2626">
+ <div class="cve-top"><span class="cve-id"><a href="https://www.cve.org/CVERecord?id=CVE-2025-31699" target="_blank" rel="noopener">CVE-2025-31699</a></span><span class="pill pill-important">Important</span><span class="cvss">CVSS 8.9</span></div>
+ <h3 class="cve-title">Origin connection still owed a request body is reused, enabling request smuggling</h3>
+ <p class="cve-desc">Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>HTTP state machine</dd></div><div><dt>Type</dt><dd class="type-dd"><span class="type-tag">Request smuggling</span></dd></div><div><dt>Fixed in</dt><dd>9.2.16 / 10.1.5 / 10.2.1</dd></div><div><dt>Reported by</dt><dd>Martin van Kervel Smedshammer, Nick Muerdter</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#dc2626">
+ <div class="cve-top"><span class="cve-id"><a href="https://www.cve.org/CVERecord?id=CVE-2025-55702" target="_blank" rel="noopener">CVE-2025-55702</a></span><span class="pill pill-important">Important</span><span class="cvss">CVSS 8.7</span></div>
+ <h3 class="cve-title">An unread Expect: 100-continue request body is framed as a new request</h3>
+ <p class="cve-desc">When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smuggle requests past the front end and desynchronize responses for other users.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>HTTP/1</dd></div><div><dt>Type</dt><dd class="type-dd"><span class="type-tag">Request smuggling</span></dd></div><div><dt>Fixed in</dt><dd>9.2.16 / 10.1.5 / 10.2.1</dd></div><div><dt>Reported by</dt><dd>Sebastiano Sartor</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#dc2626">
+ <div class="cve-top"><span class="cve-id"><a href="https://www.cve.org/CVERecord?id=CVE-2026-111805" target="_blank" rel="noopener">CVE-2026-111805</a></span><span class="pill pill-important">Important</span><span class="cvss">CVSS 8.6</span></div>
+ <h3 class="cve-title">HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion</h3>
+ <p class="cve-desc">Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>HTTP/2</dd></div><div><dt>Type</dt><dd class="type-dd"><span class="type-tag">Denial of service</span></dd></div><div><dt>Fixed in</dt><dd>9.2.16 / 10.1.5 / 10.2.1</dd></div><div><dt>Reported by</dt><dd>matrix_cain (YakLang), Alieldeen Khaled Ali, Jesse Yang, Alex Williams (Pellera Technologies), VulnCheck (coordination), The ASF</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#dc2626">
+ <div class="cve-top"><span class="cve-id"><a href="https://www.cve.org/CVERecord?id=CVE-2026-111808" target="_blank" rel="noopener">CVE-2026-111808</a></span><span class="pill pill-important">Important</span><span class="cvss">CVSS 8.6</span></div>
+ <h3 class="cve-title">HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion</h3>
+ <p class="cve-desc">Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>HTTP/2</dd></div><div><dt>Type</dt><dd class="type-dd"><span class="type-tag">Denial of service</span></dd></div><div><dt>Fixed in</dt><dd>9.2.16 / 10.1.5 / 10.2.1</dd></div><div><dt>Reported by</dt><dd>Khalilov Moe (LeetProtect), The ASF</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#dc2626">
+ <div class="cve-top"><span class="cve-id"><a href="https://www.cve.org/CVERecord?id=CVE-2026-111810" target="_blank" rel="noopener">CVE-2026-111810</a></span><span class="pill pill-important">Important</span><span class="cvss">CVSS 7.5</span></div>
+ <h3 class="cve-title">Unthrottled per-header diagnostic logging enables a log-flood denial of service</h3>
+ <p class="cve-desc">Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Header handling / logging</dd></div><div><dt>Type</dt><dd class="type-dd"><span class="type-tag">Denial of service</span></dd></div><div><dt>Fixed in</dt><dd>9.2.16 / 10.1.5 / 10.2.1</dd></div><div><dt>Reported by</dt><dd>Apache Community</dd></div></dl>
+ </article>
+ </div>
+ <div class="sev-head">
+ <span class="sev-dot" style="background:#d97706"></span>
+ <h2>Moderate</h2>
+ <span class="count">5 advisories</span>
+ </div>
+ <div class="space-y-4">
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a href="https://www.cve.org/CVERecord?id=CVE-2026-111812" target="_blank" rel="noopener">CVE-2026-111812</a></span><span class="pill pill-moderate">Moderate</span><span class="cvss">CVSS 10</span></div>
+ <h3 class="cve-title">origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials</h3>
+ <p class="cve-desc">Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin: origin_server_auth</dd></div><div><dt>Type</dt><dd class="type-dd"><span class="type-tag">Access-control bypass</span></dd></div><div><dt>Fixed in</dt><dd>9.2.16 / 10.1.5 / 10.2.1</dd></div><div><dt>Reported by</dt><dd>Apache Community</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a href="https://www.cve.org/CVERecord?id=CVE-2026-111809" target="_blank" rel="noopener">CVE-2026-111809</a></span><span class="pill pill-moderate">Moderate</span><span class="cvss">CVSS 9.3</span></div>
+ <h3 class="cve-title">HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling</h3>
+ <p class="cve-desc">Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>HTTP/1</dd></div><div><dt>Type</dt><dd class="type-dd"><span class="type-tag">Request smuggling</span></dd></div><div><dt>Fixed in</dt><dd>9.2.16 / 10.1.5 / 10.2.1</dd></div><div><dt>Reported by</dt><dd>Apache Community</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a href="https://www.cve.org/CVERecord?id=CVE-2026-111811" target="_blank" rel="noopener">CVE-2026-111811</a></span><span class="pill pill-moderate">Moderate</span><span class="cvss">CVSS 9</span></div>
+ <h3 class="cve-title">tsmemcache plugin exposes the shared proxy cache over the network with no authentication</h3>
+ <p class="cve-desc">Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin: tsmemcache</dd></div><div><dt>Type</dt><dd class="type-dd"><span class="type-tag">Access-control bypass</span></dd></div><div><dt>Fixed in</dt><dd>9.2.16 / 10.1.5 / 10.2.1</dd></div><div><dt>Reported by</dt><dd>Apache Community</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a href="https://www.cve.org/CVERecord?id=CVE-2026-112381" target="_blank" rel="noopener">CVE-2026-112381</a></span><span class="pill pill-moderate">Moderate</span><span class="cvss">CVSS 5.9</span></div>
+ <h3 class="cve-title">Nullptr dereference in net_write_io on a POST half-close with chunked response</h3>
+ <p class="cve-desc">Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>HTTP tunnel</dd></div><div><dt>Type</dt><dd class="type-dd"><span class="type-tag">Denial of service</span></dd></div><div><dt>Fixed in</dt><dd>9.2.16 / 10.1.5 / 10.2.1</dd></div><div><dt>Reported by</dt><dd>Masaori Koshiba</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a href="https://www.cve.org/CVERecord?id=CVE-2026-111817" target="_blank" rel="noopener">CVE-2026-111817</a></span><span class="pill pill-moderate">Moderate</span><span class="cvss">CVSS 5.3</span></div>
+ <h3 class="cve-title">Dropping chunked trailers stalls a passthrough transfer until timeout</h3>
+ <p class="cve-desc">Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on by default in 10.x. In 9.2.x it is off by default, and those versions are affected only if it is enabled.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>HTTP tunnel</dd></div><div><dt>Type</dt><dd class="type-dd"><span class="type-tag">Denial of service</span></dd></div><div><dt>Fixed in</dt><dd>10.1.5 / 10.2.1</dd></div><div><dt>Reported by</dt><dd>Omkhar Arasaratnam</dd></div></dl>
+ </article>
+ </div>
+ </div>
+ </section>
+ <footer class="bg-gray-50 border-t border-gray-200 mt-16">
+ <div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 py-12">
+ <div class="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-4 gap-8">
+ <div>
+ <h3 class="text-sm font-semibold text-gray-900 uppercase tracking-wider mb-4">Resources</h3>
+ <ul class="space-y-3">
+ <li><a href="https://docs.trafficserver.apache.org/en/latest/index.html" class="text-secondary hover:text-accent transition-colors">Documentation</a></li>
+ <li><a href="https://github.com/apache/trafficserver/" class="text-secondary hover:text-accent transition-colors">Source Code</a></li>
+ <li><a href="via.html" class="text-secondary hover:text-accent transition-colors">Via Header Decoder</a></li>
+ </ul>
+ </div>
+
+ <div>
+ <h3 class="text-sm font-semibold text-gray-900 uppercase tracking-wider mb-4">Community</h3>
+ <ul class="space-y-3">
+ <li><a href="users.html" class="text-secondary hover:text-accent transition-colors">Customers</a></li>
+ <li><a href="https://github.com/apache/trafficserver/issues" class="text-secondary hover:text-accent transition-colors">Issues</a></li>
+ <li><a href="https://infra.apache.org/slack.html" class="text-secondary hover:text-accent transition-colors">Slack (#traffic-server)</a></li>
+ </ul>
+ </div>
+
+ <div>
+ <h3 class="text-sm font-semibold text-gray-900 uppercase tracking-wider mb-4">Apache</h3>
+ <ul class="space-y-3">
+ <li><a href="https://www.apache.org/" class="text-secondary hover:text-accent transition-colors">Foundation</a></li>
+ <li><a href="https://www.apache.org/licenses/" class="text-secondary hover:text-accent transition-colors">License</a></li>
+ <li><a href="https://www.apache.org/security/" class="text-secondary hover:text-accent transition-colors">Security</a></li>
+ <li><a href="https://privacy.apache.org/policies/privacy-policy-public.html" class="text-secondary hover:text-accent transition-colors">Privacy</a></li>
+ <li><a href="https://www.apache.org/events/current-event.html" class="text-secondary hover:text-accent transition-colors">Events</a></li>
+ <li><a href="https://www.apache.org/foundation/sponsorship.html" class="text-secondary hover:text-accent transition-colors">Donate</a></li>
+ <li><a href="https://www.apache.org/foundation/thanks.html" class="text-secondary hover:text-accent transition-colors">Thanks</a></li>
+ </ul>
+ </div>
+
+ <div>
+ <h3 class="text-sm font-semibold text-gray-900 uppercase tracking-wider mb-4">More</h3>
+ <ul class="space-y-3">
+ <li><a href="press.html" class="text-secondary hover:text-accent transition-colors">Press Kit</a></li>
+ <li><a href="acknowledgements.html" class="text-secondary hover:text-accent transition-colors">Acknowledgements</a></li>
+ </ul>
+ </div>
+ </div>
+
+ <div class="mt-12 pt-8 border-t border-gray-200 flex flex-col md:flex-row justify-between items-center">
+ <p class="text-secondary text-sm text-center md:text-left">
+ Copyright © 2026 <a href="https://www.apache.org/" class="hover:text-accent">The Apache Software Foundation</a>.
+ Licensed under the <a href="https://www.apache.org/licenses/" class="hover:text-accent">Apache License</a>, Version 2.0.
+ Apache Traffic Server, Apache, the Apache Traffic Server logo, and the Apache feather logo are trademarks of The Apache Software Foundation.
+ </p>
+ <div class="mt-4 md:mt-0">
+ <a href="https://www.apache.org/" class="inline-block">
+ <img src="https://www.apache.org/images/feather-small.png" alt="Apache" class="h-8 w-auto">
+ </a>
+ </div>
+ </div>
+ </div>
+ </footer>
+
+ <script src="js/menu.js"></script>
+</body>
+</html>
diff --git a/source/templates/index.template.html b/source/templates/index.template.html
index 97ab57a..ecc13a9 100644
--- a/source/templates/index.template.html
+++ b/source/templates/index.template.html
@@ -82,7 +82,7 @@ To update:
<!-- HOT TOPIC BANNER - current security release -->
<!-- Update the text/link here when the featured topic changes. -->
<!-- ============================================================ -->
- <a href="security-2026-07.html" class="block" style="background:linear-gradient(135deg,#d97706 0%,#b45309 100%);border-top:3px solid #78350f;box-shadow:0 4px 16px rgba(180,83,9,.4);text-decoration:none;" aria-label="July 2026 CVE release security advisory">
+ <a href="security-2026-10.html" class="block" style="background:linear-gradient(135deg,#d97706 0%,#b45309 100%);border-top:3px solid #78350f;box-shadow:0 4px 16px rgba(180,83,9,.4);text-decoration:none;" aria-label="October 2026 CVE release security advisory">
<div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8" style="padding-top:.9rem;padding-bottom:.9rem;">
<div class="flex flex-col sm:flex-row items-center justify-between gap-4">
<div class="flex items-center gap-4">
@@ -91,8 +91,8 @@ To update:
</svg>
<span class="flex-shrink-0" style="display:inline-block;background:#1e3a8a;color:#fff;font-size:.85rem;font-weight:800;letter-spacing:.1em;padding:.4rem .9rem;border-radius:9999px;white-space:nowrap;box-shadow:0 1px 3px rgba(0,0,0,.25);">SECURITY RELEASE</span>
<div style="color:#fff;line-height:1.35;text-shadow:0 1px 2px rgba(0,0,0,.28);">
- <div style="font-size:1.2rem;font-weight:700;letter-spacing:.01em;">July 2026 CVE Release</div>
- <div style="font-size:1.02rem;opacity:.95;"><strong>34</strong> vulnerabilities fixed in Apache Traffic Server 9.2.14 & 10.1.3. Upgrading is strongly recommended.</div>
+ <div style="font-size:1.2rem;font-weight:700;letter-spacing:.01em;">October 2026 CVE Release</div>
+ <div style="font-size:1.02rem;opacity:.95;"><strong>15</strong> vulnerabilities fixed in Apache Traffic Server 9.2.16, 10.1.5 & 10.2.1. Upgrading is strongly recommended.</div>
</div>
</div>
<span class="ats-alert-cta" style="display:inline-block;background:#fff;color:#b45309;font-weight:700;font-size:.98rem;letter-spacing:.01em;padding:.65rem 1.35rem;border-radius:.5rem;white-space:nowrap;box-shadow:0 3px 12px rgba(0,0,0,.2);">Read the advisory →</span>
diff --git a/source/versions.json b/source/versions.json
index 03b6ef9..cdbbb1a 100644
--- a/source/versions.json
+++ b/source/versions.json
@@ -20,7 +20,7 @@
"news": [
{
"date": "October 20, 2026",
- "text": "Apache Traffic Server <strong>v10.2.1</strong> and <strong>v10.1.5</strong> security release."
+ "text": "Apache Traffic Server <strong>v10.2.1</strong> and <strong>v10.1.5</strong> security release. Read the <a href=\"security-2026-10.html\" class=\"text-accent underline\">October 2026 CVE release advisory</a>."
},
{
"date": "October 20, 2026",