CVE-2026-111811
Apache Traffic Server advisory batch of 2026-10-22: the experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration (RCE), the experimental tsmemcache plugin allows anonymous read, write and delete of the shared proxy cache, a malformed 302 slips past the parse-error path through the Transfer-Encoding: chunked carve-out and is then cached and served (cache poisoning / response desync), and an origin connection is returned to the shared pool while the origin is still waiting on a declared-but-unsent request body (request smuggling past ATS access controls)
- Severity
- critical
- Affected product
- Apache Traffic Server
- Affected versions
- Apache Traffic Server ≥ 9.0.0, < 9.2.16
- Fixed in
- Apache Traffic Server 9.2.16
- Detection basis
- Component version range
- Shipped rule
- Apache Traffic Server: Apache Traffic Server advisory batch of 2026-10-22: the experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration (RCE), the experimental tsmemcache plugin allows anonymous read, write and delete of the shared proxy cache, a malformed 302 slips past the parse-error path through the Transfer-Encoding: chunked carve-out and is then cached and served (cache poisoning / response desync), and an origin connection is returned to the shared pool while the origin is still waiting on a declared-but-unsent request body (request smuggling past ATS access controls)
- Added to NewScan
- 2026-10-22
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
COMPONENT VERSION RANGE
NewScan fingerprints Apache Traffic Server from its response and reports this CVE when the detected version falls inside the affected range below.
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →Review the measured benchmark, then use the verified remediation process.