Apache Traffic Server: 15 vulnerabilities fixed including critical magick plugin command injection and request smuggling flaws (CVE-2026-111813 et al.)
Severity: critical · Patch status: patched · Since 2026-10-20 · CVE-2025-31699, CVE-2025-55702, CVE-2026-111804, CVE-2026-111805, CVE-2026-111808, CVE-2026-111813, CVE-2026-111816
The Apache Software Foundation announced fixes for 15 vulnerabilities in Apache Traffic Server, addressed in versions 9.2.16, 10.1.5 and 10.2.1. The most severe (CVE-2026-111813, CVSS 10.0) lets an unauthenticated client control ImageMagick convert arguments via the experimental magick plugin's default configuration. Other issues include a wasm plugin use-after-free and unvalidated metric IDs (CVE-2026-111804), request smuggling via reused origin connections owed a request body (CVE-2025-31699) and unread Expect: 100-continue bodies (CVE-2025-55702), cache poisoning via a malformed 302 bypassing parse-error rejection (CVE-2026-111816), and HTTP/2-triggered origin worker-pool exhaustion (CVE-2026-111805, CVE-2026-111808). All ATS versions 9.0.0 through 10.2.0 are affected; no in-the-wild exploitation is reported. Fixes are available in the new releases.
What to do
- Upgrade to ATS 9.2.16, 10.1.5 or 10.2.1 immediately, prioritising internet-facing deployments
- Disable or remove the experimental magick and wasm plugins if not strictly needed, especially on unpatched instances
- Review access controls and front-end proxy connection sharing given the request smuggling and cache poisoning flaws
- Monitor for signs of cache poisoning or request desync in logs after upgrading
Fixed versions
Sources
All live incidents on Threat Watch
