psf-trafficserver-check(8)

Script: /opt/psf-security-patches/trafficserver/trafficserver-check.sh. Tool page: Apache Traffic Server. Source. With the package installed: man psf-trafficserver-check.

Apache Traffic Server experimental plugins, October 2026: read-only checker  (v1)
CVE-2026-111813 (magick plugin, CVSS 10.0)
CVE-2026-111811 (tsmemcache plugin, CVSS 9.0)

If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation

Apache Traffic Server (ATS) is a caching reverse and forward proxy used in front
of large sites and CDNs. The October 2026 release fixes 15 vulnerabilities. Two of
them sit in EXPERIMENTAL plugins and are the severe ones:

CVE-2026-111813  The magick plugin passes client query strings unfiltered to
                 ImageMagick's convert in its default (unsigned) configuration,
                 so an unauthenticated client controls convert's arguments:
                 command injection / argument injection. CVSS 10.0, critical.
CVE-2026-111811  The tsmemcache plugin exposes the shared proxy cache over the
                 network with no authentication: unauthenticated read, write and
                 deletion of the cache. CVSS 9.0 by Apache's rating (Moderate on
                 their scale), listed as 9.4 Critical by some aggregators.

  Affected: 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, 10.2.0
            (the magick plugin from 8.0.1)
  Fixed:    9.2.16, 10.1.5 and 10.2.1 (released 20 October 2026)
  Move to:  a fixed branch. 8.x, 9.0, 9.1 and 10.0 are end of life branches

Both flaws only matter when the plugin is LOADED. The script therefore reads the
configuration (plugin.config and the remap files) for magick.so and tsmemcache.so
rather than looking for files: the plugins are experimental, are not enabled by
default, and a magick.so on disk can just as well be an ImageMagick coder.

The same release fixes thirteen other flaws (request smuggling, cache poisoning,
denial of service) that only the update fixes.

This script is read-only. It finds traffic_server (PATH, usual locations and running
processes), reads its version from "traffic_server -V", reads the configuration
directory, and checks the owning package's changelog for a backported fix.

Usage:
  ./trafficserver-check.sh [command] [PATH-TO-traffic_server ...]

  check (default)  Exit 0 = nothing exposed, 1 = an affected version loads one of
                   the two plugins, or its configuration could not be read.
  version          print the script version.

Environment: ATS_CONFIG_DIR (space separated directories) replaces config discovery.
Containers: with no argument the check also looks in running docker and podman containers
(SCAN_CONTAINERS=1, the default; 0 skips them). A read-only probe captures the output of
traffic_server -V and the configuration files with every line that does not load magick.so or
tsmemcache.so blanked inside the container (so credentials never leave it, and line numbers stay
exact) into a private temporary directory, and this script then runs once per container in
isolation against that copy. Paths shown as .../docker_NAME/... are inside the container NAME.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.