APACHE Traffic Server users face a substantial round-up of flaws disclosed in October 2026, with 15 CVEs spanning core proxy functionality and experimental plugins. The most severe entry is CVE-2026-111813 (CVSS 10.0) in the experimental magick plugin, which in its default configuration lets an unauthenticated client control ImageMagick convert arguments.
Other high-severity issues include CVE-2026-111811 (CVSS 9.4) in the tsmemcache plugin, exposing the shared proxy cache over the network with no authentication, and CVE-2026-111816 (CVSS 9.2), which can permit a malformed redirect to bypass parse-error rejection, enabling cache poisoning and cache desynchronisation.
Additional concerns involve CVE-2025-31699 (CVSS 9.1) and CVE-2025-55702 (noted in the article under related references) that can allow request smuggling, with a HEAD request flaw CVE-2026-111809 (CVSS 6.9) also contributing to smuggling opportunities.
Affected versions include 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0; patches are published for 9.2.16, 10.1.5 and 10.2.1. The update guidance emphasises disabling experimental plugins (magick, tsmemcache, wasm) if not required, and moving off the 8.x branch where fixes are not listed. The article notes that, as yet, no exploitation in the wild is confirmed.
It also highlights how cache poisoning and request smuggling could enable attackers to serve poisoned content or slip past access controls, underscoring the need for prompt patching.