Description
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.



This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.
Published: 2026-10-21
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Memory Corruption
Action: Immediate Upgrade
AI Analysis

Impact

Apache Traffic Server’s experimental WebAssembly plugin contains a use‑after‑free bug in its transaction‑close handler, and it forwards unvalidated guest‑supplied metric identifiers to the internal statistics API. This unsafe memory reference and unvalidated parameter forwarding can lead to memory corruption, which may cause the server to crash or exhibit unintended behavior. The vulnerability is categorized as a use‑after‑free (CWE-416) and an unsafe handling of external input (CWE-825).

Affected Systems

The flaw affects Apache Traffic Server from version 10.0.0 through 10.1.4 and the 10.2.0 release. The vendor is Apache Software Foundation and the product is Apache Traffic Server.

Risk and Exploitability

Based on the description, the likely attack vector is remote, via a malicious WebAssembly module submitted to the server; the attacker only needs to supply a crafted module or metric identifiers. The CVSS score of 8.8 indicates a high severity, while the EPSS score of < 1% indicates a very low but nonzero exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The use‑after‑free and forwarding of unvalidated guest metric IDs could result in memory corruption, potentially leading to server crashes or other unintended behavior.

Generated by OpenCVE AI on October 29, 2026 at 20:29 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache Traffic Server to at least 10.1.5 or 10.2.1, which contain the fix for the use‑after‑free.
  • Disable the experimental wasm plugin when it is not necessary to prevent unsafe memory access and unchecked metric ID forwarding.
  • Apply additional controls such as restricting the loading of WebAssembly modules to trusted sources and validating metric IDs before forwarding to the internal stats API.

Generated by OpenCVE AI on October 29, 2026 at 20:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 23 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache apache Traffic Server
Apache traffic Server
Apache Software Foundation
Apache Software Foundation apache Traffic Server
Vendors & Products Apache
Apache apache Traffic Server
Apache traffic Server
Apache Software Foundation
Apache Software Foundation apache Traffic Server

Wed, 21 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.
Title Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Apache Apache Traffic Server Traffic Server
Apache Software Foundation Apache Traffic Server
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-23T21:23:16.760Z

Reserved: 2026-10-16T20:15:36.197Z

Link: CVE-2026-111804

cve-icon Vulnrichment

Updated: 2026-10-23T20:52:14.201Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T19:16:59.007

Modified: 2026-10-23T22:16:55.410

Link: CVE-2026-111804

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-21T18:21:32Z

Links: CVE-2026-111804 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T20:30:18Z

Weaknesses