28 matches found
CVE-2026-111804
A flaw was found in Apache Traffic Server's experimental WebAssembly WASM plugin. A remote attacker can trigger a use-after-free condition during transaction closure or supply unvalidated metric identifiers to the internal statistics interface. This flaw allows an attacker to cause an application...
Linux Distros Unpatched Vulnerability : CVE-2026-111804
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the...
DEBIAN-CVE-2026-111804
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...
CVE-2026-111804
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...
CVE-2026-111804
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...
UBUNTU-CVE-2026-111804
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...
CVE-2026-111804 Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...
CVE-2026-111804
The Apache Traffic Server experimental wasm plugin is vulnerable to a use-after-free flaw located in its transaction-close handler . Additionally, the plugin forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue impacts versions 10.0.0 through 10.1.4 and 10.2.0 . Af...
CVE-2026-111804 Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...
EUVD-2026-107490
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...
CVE-2026-111804
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...
EUVD-2026-105135
Vite: First 4 bytes of files outside of server.fs setting is exposed by ?vite-wasm-instance...
UBUNTU-CVE-2026-112947
Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal...
PT-2026-120767
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...
CVE-2026-112947
Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal...
CVE-2026-112947
Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal...
Apache Traffic Server resource management error vulnerability
Versions 10.0.0 through 10.1.4 and 10.2.0 of Apache Traffic Server contain a resource management error vulnerability. This vulnerability stems from post-free reuse in the transaction close handler within an experimental WASM plugin, which forwards unvalidated metric IDs provided by guests to an...
CVE-2026-112947 Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal...
CVE-2026-112947 Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal...
CVE-2026-112947
The Vite frontend tooling framework (versions 8.2.0 through 8.2.4 and 8.3.3 ) is vulnerable to a path traversal and information exposure flaw. An attacker can request files outside the server.fs setting by using the ?vite-wasm-instance query parameter. The internal Wasm plugin's load hook handles...