Apache Traffic Server fixes multiple flaws in 9.2.16, 10.1.5 and 10.2.1
Original title: CVE-2026-111813 etc: Multiple vulnerabilities in Apache Traffic Server prior to 9.2.16/10.1.5/10.2.1
An oss-security forward of Apache's October 20 note names CVE-2026-111813, but this excerpt omits each flaw's impact.
Valtteri Vuorikoski forwarded an Apache Traffic Server security announcement to oss-security. Masakazu Kitajo told the project lists on October 20 that multiple vulnerabilities are fixed in 9.2.16, 10.1.5 and 10.2.1. The visible title also cites CVE-2026-111813. The excerpt ends before describing the individual issues.
Unconfirmed: The excerpt is cut off, so severity and exploitation status are not stated.
- The forwarded announcement is dated October 20, 2026.
- Fixed versions named are 9.2.16, 10.1.5 and 10.2.1.
- Only CVE-2026-111813 appears by identifier in the visible text.
- Releases before those versions are the stated affected range.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Traffic Server | prior to 9.2.16, 10.1.5 and 10.2.1 | 9.2.16, 10.1.5 and 10.2.1 |
- 1.Upgrade Apache Traffic Server to 9.2.16, 10.1.5 or 10.2.1.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111813 | Argument injection in Apache Traffic Server magick plugin | 10.0 | — |
From the original article
Posted by Valtteri Vuorikoski on Oct 24 Announcement below was posted to the Apache Traffic Server mailing lists a few days ago. ----- Forwarded message from Masakazu Kitajo ----- Date: Tue, 20 Oct 2026 20:07:34 -0600 From: Masakazu Kitajo To: announce () trafficserver apache org, users Subject: [SECURITY] Multiple vulnerabilities fixed in Apache Traffic Server 9. 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.