Apache Traffic Server: Use-after-free in experimental wasm plugin
Summary
The experimental wasm plugin of Apache Traffic Server 10.0.0 through 10.1.4 and 10.2.0 contains a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. A network-based attacker without login could potentially crash the server or execute code, but only if the wasm plugin is loaded. Standard deployments without this plugin are not in scope.
Affected
- Apache Traffic Server 10.0.0 through 10.1.4
- Apache Traffic Server 10.2.0
- Only instances with the experimental wasm plugin loaded
- Unknown whether 9.x versions are affected (conflicting information, see recommendation)
Fixed in
- Apache Traffic Server 10.1.5 (for 10.1.x)
- Apache Traffic Server 10.2.1 (for 10.2.x)
- Fix for 9.2.x: Unknown, to be verified against the vendor advisory
Workaround
- No vendor-documented interim mitigation known.
- Unverified: unloading the wasm plugin, if it is not required, removes the exposed code path. Confirm before rollout.
Exploitation
- No reports of active exploitation known. Not listed in CISA KEV as of the research notes.
- A public proof of concept is claimed by a third party but is unconfirmed.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Inventory all Apache Traffic Server instances and check whether the wasm plugin is loaded.
- If the plugin is loaded and the version is 10.0.0 to 10.1.4 or 10.2.0, upgrade to 10.1.5 or 10.2.1, prioritising internet-facing instances.
- If the plugin is not loaded, classify the item as low priority and recheck the NVD entry once analysis is published.
- Verify the 9.2.x status on the vendor advisory page before closing any 9.2.x tickets.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Traffic Server security advisory October 2026 trafficserver.apache.org
- Apache mailing list thread on CVE-2026-111804 lists.apache.org
- NVD / Vulners record CVE-2026-111804 vulners.com
- CISA KEV alert 26 October 2026 www.cisa.gov
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:07.
Original description (NVD)
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.