Apache: 25 Vulnerabilities Disclosed Across Traffic Server, Pulsar, and More in Coordinated Batch

Key findings

25 CVEs disclosed across Apache Traffic Server, mod_qos, DataSketches, and Pulsar between Oct 21-22, 2026.
Multiple Critical (CVSS 10.0) vulnerabilities in Apache Traffic Server include TLS session reuse and request smuggling.
Apache Traffic Server affected by numerous high and critical flaws impacting request handling, TLS, and plugins.
Apache Pulsar Manager and core components face critical and high-severity security issues, including authorization flaws and API vulnerabilities.
Apache mod_qos has medium and low severity flaws related to request processing and buffer boundary checks.
Users urged to upgrade Apache Traffic Server to patched versions like 9.2.16, 10.1.5, or 10.2.1.

On October 21-22, 2026, a significant batch of 25 vulnerabilities was disclosed across multiple Apache projects, including Apache Traffic Server, Apache mod_qos, Apache DataSketches C++, and Apache Pulsar. The vulnerabilities range in severity from Low to Critical, with several critical flaws in Apache Traffic Server posing the most immediate risk to users. These disclosures highlight potential weaknesses in request handling, security evaluations, and plugin functionalities within these widely used Apache projects.

Apache Traffic Server Vulnerabilities

A substantial number of the disclosed vulnerabilities affect Apache Traffic Server, a high-performance, proxy-based caching HTTP reverse proxy.

Critical Vulnerabilities (CVSSv3 10.0):
CVE-2026-111813: The experimental magick plugin, when using its default unsigned configuration, allows unauthenticated clients to control ImageMagick convert arguments, potentially leading to arbitrary code execution.
CVE-2026-111814: A flaw in the default outbound session-sharing policy allows a pooled TLS session authenticated with one client certificate to be reused for a transaction requiring a different certificate, undermining client authentication.
CVE-2026-111815: A critical vulnerability exists where a truncated HTTP/2 Content-Length value can be used to exhaust an HTTP/1.1 origin's worker pool, leading to a denial-of-service condition.
CVE-2026-111808: Similar to CVE-2026-111815, a malformed padded HTTP/2 DATA frame can also be used to exhaust an HTTP/1.1 origin's worker pool.
CVE-2026-111809: Request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding headers can be exploited.
CVE-2026-111816: A malformed 302 response that should have been rejected as a parse error was forwarded due to a Transfer-Encoding: chunked carve-out bypassing the rejection path, potentially leading to cache poisoning and response-framing desynchronization.
CVE-2026-111810: A high-severity issue (CVSSv3 7.5) involves the logging of unthrottled diagnostic data for every stripped @ header, which can lead to excessive log writes.

Critical Vulnerabilities (CVSSv3 9.0/9.3):
CVE-2026-111811 (CVSSv3 9.0): The experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache.
CVE-2026-111809 (CVSSv3 9.3): Request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding headers.
CVE-2026-111816 (CVSSv3 9.3): A malformed 302 response that should have been rejected as a parse error was forwarded due to a Transfer-Encoding: chunked carve-out bypassing the rejection path, potentially leading to cache poisoning and response-framing desynchronization.

Other Traffic Server Vulnerabilities:
CVE-2026-112381 (Medium): A null pointer dereference can occur when a client POST request is torn down via half-close while a chunked origin response is being re-parsed.
CVE-2026-111817 (Medium): A stalled chunked transfer can occur when trailers are dropped, causing the server to wait for dropped trailer bytes until the connection times out.
CVE-2026-111804 (High): The experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.

Affected versions for many of these Apache Traffic Server vulnerabilities include ranges from 8.0.0 through 10.2.0. Users are recommended to upgrade to specific patched versions such as 9.2.16, 10.1.5, or 10.2.1, depending on the specific CVE.

Apache mod_qos and DataSketches Vulnerabilities

Several vulnerabilities were also disclosed for the Apache mod_qos module, which provides quality of service control for Apache HTTP Server.

CVE-2026-114460 (Medium): An off-by-one pointer calculation error during the merging of request body parameters with an existing URL query can truncate the query string during security evaluation while leaving the actual request unchanged.
CVE-2026-114458 (Medium): An unauthenticated remote attacker can cause a Denial of Service (DoS) by maintaining numerous concurrent low-rate connections, as the module fails to verify array boundaries when recording client IP addresses.
CVE-2026-114459 (Low): Improper boundary checking when inspecting HTTP response bodies can cause the module to read memory outside allocated buffer boundaries, leading to a crash.
CVE-2026-114457 (Low): Improper string termination during the processing of percent-encoded input when JSON body filtering is enabled can lead to reading past allocated memory boundaries, causing a DoS.

Additionally, CVE-2026-103634 (severity not specified in input) affects Apache DataSketches C++, involving an out-of-bounds read and write in the Count-Min sketch deserialization due to a missing preamble size check.

Apache Pulsar Vulnerabilities

A set of vulnerabilities impacting Apache Pulsar and its management console were also part of this disclosure batch.

CVE-2026-105944 (Critical): Apache Pulsar Manager, the web console for administering Pulsar clusters, has security issues related to its user accounts, login, and its use of HTTP authentication credentials to call the Pulsar admin API.
CVE-2026-105945 (High): The Pulsar Packages Management Service, when configured to store packages on the broker's local filesystem, has authorization flaws based only on tenant and namespace, not on storage provider details.
CVE-2026-105942 (High): Two flaws exist in how brokers authorize proxy roles when acting on behalf of other users, potentially allowing a principal to exceed their own permissions.
CVE-2026-105937 (High): Shadow topics, configured via a reserved topic property, can be created by the admin REST API without proper validation.
CVE-2026-105936 (Medium): The Pulsar Functions worker REST API provides endpoints that return the catalog of Pulsar IO connectors, which could potentially be misused.
CVE-2026-105935 (Medium): The Pulsar Functions Worker's REST API endpoint for triggering a function performs a publish with its own broker client credentials, which could be exploited if not properly secured.
CVE-2026-105938 (Low): Namespace configurations restricting subscription roles may not be fully enforced for topic-level subscription operations.

Response and Mitigation

Users of Apache Traffic Server are strongly advised to upgrade to the patched versions specified in the advisories to mitigate the critical and high-severity vulnerabilities. For Apache mod_qos, users should update to versions that address these specific flaws. Apache Pulsar users should consult the relevant advisories for specific version updates and configuration recommendations to address the security issues in Pulsar Manager and the core Pulsar components.

This coordinated disclosure event underscores the importance of timely patching and security reviews for complex software ecosystems like Apache's. Users should prioritize updating affected components to prevent potential exploitation of these newly revealed weaknesses.