Servers, proxies and network services

Apache Traffic Server: CVE-2026-111813 and CVE-2026-111811 experimental plugins

Apache Traffic Server check

Apache Traffic Server (ATS) is a caching reverse and forward proxy used in front of large sites and CDNs. Its October 2026 security release fixes 15 vulnerabilities. Two of them are in experimental plugins and are the severe ones:

Both flaws only matter when the plugin is loaded. The plugins are experimental and not enabled by default. So the tool reads the configuration (plugin.config and the remap files) for magick.so and tsmemcache.so rather than looking for files. This matters: on a typical Ubuntu host the only magick.so on disk is an ImageMagick coder, not the ATS plugin, and a check that merely searched for the file would give a false alarm.

Quick start

1. Download the script. The repository is mirrored on GitHub and Codeberg; pick a base URL.

   # BASE from GitHub:   https://raw.githubusercontent.com/PrivacySafe/security-patches/refs/heads/main
   # BASE from Codeberg: https://codeberg.org/PrivacySafe/security-patches/raw/branch/main
   # curl -fLO "$BASE/trafficserver/trafficserver-check.sh"
   curl -fLO https://raw.githubusercontent.com/PrivacySafe/security-patches/refs/heads/main/trafficserver/trafficserver-check.sh
   

2. Read it before running it, then make it executable.

   less trafficserver-check.sh
   chmod +x trafficserver-check.sh
   

3. Check this host. It finds traffic_server on PATH, in the usual locations and from running processes, and reads the configuration directory (/etc/trafficserver and the other usual places). To point it elsewhere, set ATS_CONFIG_DIR.

   ./trafficserver-check.sh check
   ATS_CONFIG_DIR=/opt/ts/etc/trafficserver ./trafficserver-check.sh check
   

Commands

Environment: ATS_CONFIG_DIR (space separated directories) replaces configuration discovery.

Exit codes: 0 nothing exposed, 1 an affected version loads one of the plugins, or its configuration could not be read, 2 bad arguments.

How to read the result

• Affected version, plugin loaded: exposed. The script prints the file and line number. Upgrade, and remove the plugin line until you have.
• Affected version, neither plugin loaded: exit 0: these two flaws are not reachable. The script still warns to update, because the same release fixes thirteen other flaws.
• End-of-life branch (8.x, 9.0, 9.1, 10.0): always reported as in the affected range with no upstream fix. With neither plugin loaded it exits 0 but tells you to plan the move.
• Configuration directory not found or unreadable: treated as exposed.
• The plugin name must match exactly. libmagick.so, notmagick.so and xtsmemcache.so are not the plugins and are not matched. A full path such as /opt/ts/libexec/trafficserver/magick.so is.
• Distribution packages often backport fixes without changing the version, so the script reads the package changelog for a mention of either CVE.

Fixing it

Upgrade to 9.2.16, 10.1.5 or 10.2.1, or to a distribution build that carries the fix, and restart Traffic Server. Until then, remove magick.so and tsmemcache.so from plugin.config and the remap files and restart. That is PrivacySafe's recommendation. Neither plugin is enabled by default and both are experimental.

Sources

• Apache Traffic Server October 2026 CVE release
• Apache announcement: multiple vulnerabilities fixed in 9.2.16, 10.1.5 and 10.2.1

Before you run it

• The fix. Update to 9.2.16, 10.1.5 or 10.2.1. The 8.x, 9.0, 9.1 and 10.0 branches are end of life: move to a fixed branch.
• Both severe flaws are in experimental plugins and only matter when the plugin is loaded (magick for CVE-2026-111813, tsmemcache for CVE-2026-111811). The script reads the configuration to see whether it is. The October release fixes 15 vulnerabilities in all. Only these two are covered, and the other thirteen (request smuggling, cache poisoning, denial of service) are fixed only by the update.
• It reads the configuration, not the files. The script looks in plugin.config and the remap files for magick.so and tsmemcache.so, because the plugins are experimental and not enabled by default, and a magick.so on disk can just as well be an ImageMagick coder. It also reads the version from traffic_server -V and checks the owning package's changelog for a backported fix.
• There is no hunt. No indicators of exploitation have been published.
• It also checks running docker and podman containers, unless you name a directory or set SCAN_CONTAINERS=0. In each running container, a read-only probe captures the output of traffic_server -V and the configuration files. Every line that does not load magick.so or tsmemcache.so is blanked inside the container, so remap tokens and other credentials never leave it and line numbers stay exact. The script then runs once per container in isolation. A path shown as .../docker_NAME/... is inside the container NAME.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.

Edit this page on Codeberg