CVE-2026-58151

Analyzed Analyzed - Analysis Complete

Denial of Service in Apache Traffic Server

Publication date: 2026-07-29

Last updated on: 2026-08-03

Assigner: Apache Software Foundation

Description

Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-03

Generated

2026-08-18

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-17

NVD

CVE-2026-58151

EUVD

EUVD-2026-50203

Affected Vendors & Products

Vendor	Product	Version / Range
apache	traffic_server	From 10.0.0 (inc) to 10.1.4 (exc)
apache	traffic_server	From 8.0.0 (inc) to 8.1.9 (inc)
apache	traffic_server	From 9.0.0 (inc) to 9.2.15 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are vulnerable to crashes or resource exhaustion due to abusive HTTP/2 framing and flow-control. This can cause the server to become unresponsive or crash entirely.

Detection Guidance

Detecting this vulnerability requires monitoring Apache Traffic Server logs for crashes or resource exhaustion events. Check for HTTP/2 framing errors or flow-control issues in logs. No specific commands are provided in the context.

Impact Analysis

This vulnerability can lead to denial-of-service conditions, making the server unavailable for legitimate users. It may also consume excessive system resources, degrading performance or causing crashes.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing service disruptions or resource exhaustion in Apache Traffic Server, potentially leading to unauthorized access or data processing interruptions. Denial-of-service conditions may violate availability requirements in these regulations.

Mitigation Strategies

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 immediately to fix the issue. If upgrading is not possible, restrict access to HTTP/2 endpoints or disable HTTP/2 support as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-58151. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70