{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "Apache Software Foundation Apache Traffic Server: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/apache-software-foundation--apache-traffic-server/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/apache-software-foundation--apache-traffic-server/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111812/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111812/",
   "title": "CVE-2026-111812 · Apache Software Foundation Apache Traffic Server · disclosed",
   "content_text": "Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.",
   "date_published": "2026-10-21T19:18:19Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111811/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111811/",
   "title": "CVE-2026-111811 · Apache Software Foundation Apache Traffic Server · disclosed",
   "content_text": "Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.",
   "date_published": "2026-10-21T19:17:32Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111809/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111809/",
   "title": "CVE-2026-111809 · Apache Software Foundation Apache Traffic Server · disclosed",
   "content_text": "Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.",
   "date_published": "2026-10-21T19:16:16Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111810/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111810/",
   "title": "CVE-2026-111810 · Apache Software Foundation Apache Traffic Server · disclosed",
   "content_text": "Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains.\n\n\n\nThis issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.",
   "date_published": "2026-10-21T19:14:50Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111815/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111815/",
   "title": "CVE-2026-111815 · Apache Software Foundation Apache Traffic Server · disclosed",
   "content_text": "Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.",
   "date_published": "2026-10-21T19:13:55Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111814/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111814/",
   "title": "CVE-2026-111814 · Apache Software Foundation Apache Traffic Server · disclosed",
   "content_text": "Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one.\n\n\n\nThis issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.",
   "date_published": "2026-10-21T19:13:06Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111808/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111808/",
   "title": "CVE-2026-111808 · Apache Software Foundation Apache Traffic Server · disclosed",
   "content_text": "Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.",
   "date_published": "2026-10-21T19:11:59Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111805/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111805/",
   "title": "CVE-2026-111805 · Apache Software Foundation Apache Traffic Server · disclosed",
   "content_text": "Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.",
   "date_published": "2026-10-21T19:10:46Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111816/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111816/",
   "title": "CVE-2026-111816 · Apache Software Foundation Apache Traffic Server · disclosed",
   "content_text": "Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-framing desync.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.",
   "date_published": "2026-10-21T18:26:32Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2025-55702/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2025-55702/",
   "title": "CVE-2025-55702 · Apache Software Foundation Apache Traffic Server · disclosed",
   "content_text": "When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smuggle requests past the front end and desynchronize responses for other users.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.",
   "date_published": "2026-10-21T18:24:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2025-31699/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2025-31699/",
   "title": "CVE-2025-31699 · Apache Software Foundation Apache Traffic Server · disclosed",
   "content_text": "Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.",
   "date_published": "2026-10-21T18:22:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111804/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111804/",
   "title": "CVE-2026-111804 · Apache Software Foundation Apache Traffic Server · disclosed",
   "content_text": "Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.\n\n\n\nThis issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.",
   "date_published": "2026-10-21T18:21:32Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111813/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111813/",
   "title": "CVE-2026-111813 · Apache Software Foundation Apache Traffic Server · disclosed",
   "content_text": "Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.",
   "date_published": "2026-10-21T18:20:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102795/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102795/",
   "title": "CVE-2026-102795 · Apache Software Foundation Apache Traffic Server · disclosed",
   "content_text": "Improper Access Control vulnerability in Apache Traffic Server.\n\n\n\nThis issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.\n\n\n\nUsers are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.\n\n\n\nThis CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.",
   "date_published": "2026-10-02T17:40:50Z"
  }
 ]
}