CVE-2026-111804: Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.
This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.1.5 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.2.1
Event History
Frequently Asked Questions
Which deployments are affected?
Apache Traffic Server versions 10.0.0 through 10.1.4 and version 10.2.0 are affected. The issue is in the experimental wasm plugin.
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What versions remediate the issue?
Upgrade to Apache Traffic Server 10.1.5 or 10.2.1, which fix the issue.