Apache Traffic Server has addressed 15 security vulnerabilities affecting its proxy and caching functionality, including a critical flaw in the experimental magick plugin rated CVSS 10.0. The vulnerabilities could allow unauthenticated attackers to execute commands through ImageMagick, access or manipulate shared caches, perform HTTP request smuggling and cache poisoning, bypass TLS client-certificate verification, or trigger denial-of-service conditions. Successful exploitation could compromise proxy security, expose sensitive information, and disrupt web services.
- CVE-2026-111813 (CVSS 10.0 – Critical): The experimental magick plugin passes client-controlled query strings to ImageMagick's convert utility without adequate filtering in its default configuration, potentially allowing unauthenticated attackers to control command arguments and execute arbitrary commands.[/subscribe_to_unlock_form]
Apache Traffic Server has addressed 15 security vulnerabilities affecting its proxy and caching functionality, including a critical flaw in the experimental magick plugin rated CVSS 10.0. The vulnerabilities could allow unauthenticated attackers to execute commands through ImageMagick, access or manipulate shared caches, perform HTTP request smuggling and cache poisoning, bypass TLS client-certificate verification, or trigger denial-of-service conditions. Successful exploitation could compromise proxy security, expose sensitive information, and disrupt web services.
- CVE-2026-111813 (CVSS 10.0 – Critical): The experimental magick plugin passes client-controlled query strings to ImageMagick's convert utility without adequate filtering in its default configuration, potentially allowing unauthenticated attackers to control command arguments and execute arbitrary commands.[emaillocker id="1283"]
- CVE-2026-111811 (CVSS 9.4 – Critical): The experimental tsmemcache plugin exposes the shared proxy cache without authentication, potentially allowing remote attackers to read, modify, or delete cached data.
- CVE-2026-111816 (CVSS 9.2 – Critical): Improper handling of malformed HTTP 302 responses containing Transfer-Encoding: chunked could bypass parsing-error rejection, enabling cache poisoning and HTTP response-framing desynchronization.
- CVE-2025-31699 (CVSS 9.1 – Critical): Reusing an origin-server connection while a previous request body remains outstanding could enable HTTP request smuggling and allow malicious requests to bypass proxy security controls.
- CVE-2026-111815 (CVSS 7.8 – High): TLS session-ticket resumption could bypass strict per-server-name client-certificate verification requirements, potentially allowing unauthorized client authentication.
- CVE-2026-111814 (CVSS 7.8 – High): An incorrect default server-session-sharing configuration could cause connections with different mutual TLS client identities to share an origin connection, potentially resulting in identity confusion.
- CVE-2026-111812 (CVSS 7.0 – High): The origin_server_auth plugin could sign attacker-controlled AWS headers using the proxy's IAM credentials, potentially enabling unauthorized requests against AWS services.
- CVE-2026-111809 (CVSS 6.9 – Medium): Improper handling of HTTP HEAD requests containing Content-Length or Transfer-Encoding headers could enable HTTP request smuggling.
- CVE-2025-55702: An additional request-smuggling vulnerability was identified in the advisory; its CVSS score and detailed technical description are not provided in the supplied text.
- CVE-2026-112381: A regression associated with earlier flow-control backports could cause a server crash.
- CVE-2026-111817: Improper handling of HTTP chunked trailers could cause connections to stall. The fix is available in versions 10.1.5 and 10.2.1; applicability to the 9.2 branch depends on the trailer-dropping configuration.
The supplied article reports additional vulnerabilities involving use-after-free in the experimental WASM plugin, crashes, excessive logging, and origin-server resource exhaustion, but does not provide all corresponding CVE identifiers and severity scores in the provided text.
We recommend you to update Apache Traffic Server to version 9.2.16, 10.1.5, or 10.2.1 depending on your installed branch.
The following reports contain further technical details:
[/emaillocker]