CVE-2026-111811 Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-111811?
CVE-2026-111811 is a critical vulnerability in Apache Traffic Server, published on 21 Oct 2026.
Official description
Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Weakness: CWE-306
Which versions are affected by CVE-2026-111811?
How do I fix CVE-2026-111811?
No fix has been published for CVE-2026-111811 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-111811 being exploited?
There is no known exploitation of CVE-2026-111811 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-111811, GHSA-98jq-8c4p-7mh6, UBUNTU-CVE-2026-111811.