EUVD-2026-107490
GHSA-286j-qmf9-6g9f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach ATS with experimental wasm plugin enabled
-
ExploitDrive HTTP transaction to close
-
ExecutionTrigger use-after-free in close handler
-
ImpactCrash proxy or corrupt stats memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the experimental wasm plugin be explicitly loaded and enabled in Apache Traffic Server - it is not part of a default configuration, which is the primary limiting factor. The use-after-free is reached through the plugin's transaction-close handler, so a remote attacker needs only to drive HTTP transactions to completion against such an instance; the separate unvalidated-metric-ID path additionally requires the attacker to control or supply the wasm guest module. Affected builds are versions 10.0.0 through 10.1.4 and 10.2.0; instances on 10.1.5 or 10.2.1, or with the wasm plugin disabled, are not exposed. |
| Impact | Apache's CNA-assigned CVSS 4.0 score is 8.8 (AV:N/AC:L/PR:N/UI:N) with impact concentrated in availability (VA:H) and integrity (VI:L), reflecting a remotely triggerable use-after-free (CWE-416) plus unvalidated guest metric IDs reaching the internal stats API. However, the decisive real-world limiter is that the flaw lives in the EXPERIMENTAL wasm plugin, which is not loaded in default Apache Traffic Server deployments - so the network-facing PR:N/AC:L vector only applies to the subset of operators who have explicitly enabled this component. No EPSS probability, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a signal conflict: the vendor vector sets VC:N (no confidentiality impact) while the input Tags assert 'Information Disclosure' - a use-after-free can plausibly leak heap memory, so the confidentiality classification should be verified with Apache rather than treated as settled. Overall this is a genuine but conditional priority: urgent for the minority running the experimental wasm plugin, low practical risk for the typical default install. |
| Exploit ScenarioDerived | A remote attacker sends HTTP traffic to an Apache Traffic Server instance that has the experimental wasm plugin enabled, driving transactions to completion so the transaction-close handler operates on already-freed memory (use-after-free), crashing the proxy or corrupting internal state. Where the attacker also controls the loaded wasm guest module, crafted metric IDs are forwarded unvalidated into the internal stats API. No public exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 21, 2026
Unauthenticated remote attackers can drive HTTP transactions to completion against Apache Traffic Server instances that have loaded the experimental WebAssembly plugin and trigger a use-after-free in the plugin's transaction-close handler, producing memory corruption that primarily threatens availability (high) with a limited integrity impact. The same plugin also passes unvalidated guest-supplied metric IDs straight into ATS's internal stats API, a path that requires the attacker to control or supply the wasm guest module. Exposure is limited to deployments that explicitly enable this non-default experimental plugin on versions 10.0.0 through 10.1.4 or 10.2.0; no public exploit identified at time of analysis.
Earlier versions of this analysis (1)
Use-after-free in Apache Traffic Server’s experimental WebAssembly (wasm) plugin can crash the server or corrupt memory when a loaded guest module supplies unvalidated metric IDs to the internal stats API as a transaction closes. Only deployments that explicitly enable this non-default plugin and load attacker-influenced wasm content are exposed; stock configurations are not affected. No public exploit code or CISA KEV entry was identified at time of analysis, and the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H, reflecting the narrow preconditions rather than a generic unauthenticated attack against every Traffic Server instance.
RemediationAI
Vendor-released patch: upgrade to Apache Traffic Server 10.1.5 (for the 10.1.x line) or 10.2.1 (for 10.2.x), per the Apache advisory at https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc. Because the flaw lives in the experimental wasm plugin and is not reachable in a default build, the direct compensating control is to remove the plugin from the configuration (do not load the wasm plugin, or revert to a build/configuration without it) until the upgrade can be scheduled - the trade-off is loss of wasm-based request handling, so any dependent custom logic must be moved back to native plugins or remap rules. Where the plugin must remain temporarily, restrict who can supply or replace the wasm guest module to fully trusted operators, since the unvalidated-metric-ID path requires attacker control of the guest module, and place the proxy behind upstream rate limiting and health-check-driven restart automation so that repeated transaction-close crashes from the use-after-free are contained; neither measure removes the memory-corruption risk, so patching remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Traffic Server is a caching/forward proxy whose experimental WebAssembly plugin lets operators run guest modules inside the proxy's request pipeline. The core defect is CWE-416 (use-after-free): an object associated with transaction teardown is released and then dereferenced from the plugin's transaction-close handler, giving a remote, unauthenticated party (CVSS 4.0 vector AV:N/AC:L/PR:N/UI:N) a memory-corruption primitive reachable simply by completing HTTP transactions and forcing repeated transaction closes. The second, distinct weakness is a missing validation/trust-boundary check: metric identifiers supplied by the wasm guest are forwarded into ATS's internal stats API without sanitisation, so a malicious or compromised guest module can reach statistic surfaces it should not touch. Apache's CNA assigned CVSS 4.0 8.8 with availability high (VA:H) and integrity low (VI:L); the independent 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) agrees that confidentiality is not directly impacted. The affected package is captured by CPE cpe:2.3:a:apache_software_foundation:apache_traffic_server, and the practical limiting factor is configuration, not network position: the wasm plugin is not enabled by default.
Know when Apache Traffic Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Remotely triggerable via normal traffic once the wasm plugin is enabled (AV:N/AC:L/PR:N/UI:N); use-after-free crash drives A:H with limited integrity (I:L) and no confirmed confidentiality impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.
This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.
Executive ViewAI
Apache Traffic Server deployments that have enabled the non-default experimental WebAssembly plugin on versions 10.0.0 through 10.1.4 or 10.2.0 are exposed to a memory-corruption flaw that can be triggered by remote traffic and primarily disrupts service availability, with a secondary integrity concern tied to the plugin's metrics handling. Because the plugin is off by default, the realistic blast radius is limited to teams that deliberately enabled it, but any affected edge or CDN node represents a potential outage point for customer-facing traffic.
No vendor-released patch identified at time of analysis. Interim mitigations: unload or disable the experimental WebAssembly plugin on all ATS instances (the flaw is unreachable without it); where the plugin is mandatory, restrict untrusted client access via network segmentation, WAF/rate-limiting, and ACLs on stats and management interfaces; require signed and vetted guest modules so metric IDs cannot be attacker-supplied; and instrument transaction-close handling with crash and memory-corruption monitoring for early detection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Apache Traffic Server
View allApache Traffic Server versions 8.0.1 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 ship an exp
Remote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
Response-framing desync in Apache Traffic Server (8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and
Request smuggling in Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0
Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
Apache Traffic Server 9.2.15, 10.1.4, and 10.2.0 can be driven into a denial-of-service condition through log amplificat
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
Exploit-DB