CVE-2026-111804 Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs

High 8.8 Published 21 Oct 2026 Updated 23 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-111804?

CVE-2026-111804 is a high-severity vulnerability in Apache Traffic Server, published on 21 Oct 2026.

Official description

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.

This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0.

Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.

Weakness: CWE-416

Which versions are affected by CVE-2026-111804?

How do I fix CVE-2026-111804?

No fix has been published for CVE-2026-111804 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-111804 being exploited?

There is no known exploitation of CVE-2026-111804 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-111804, GHSA-286j-qmf9-6g9f, UBUNTU-CVE-2026-111804.