CVE-2026-58152

Analyzed Analyzed - Analysis Complete

Integer Overflow in Apache Traffic Server HPACK/XPACK Header Decoding

Publication date: 2026-07-29

Last updated on: 2026-08-03

Assigner: Apache Software Foundation

Description

Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-03

Generated

2026-08-18

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-17

NVD

CVE-2026-58152

EUVD

EUVD-2026-50204

Affected Vendors & Products

Vendor	Product	Version / Range
apache	traffic_server	From 10.0.0 (inc) to 10.1.4 (exc)
apache	traffic_server	From 8.0.0 (inc) to 8.1.9 (inc)
apache	traffic_server	From 9.0.0 (inc) to 9.2.15 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

Apache Traffic Server has a flaw where it mishandles integers while decoding HPACK/XPACK headers, leading to memory corruption. This occurs in versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

Detection Guidance

This vulnerability involves memory corruption due to integer mishandling in Apache Traffic Server. Detection requires checking the version of Apache Traffic Server running on your system. Use commands like 'traffic_server -v' or 'apt list --installed | grep trafficserver' to verify the installed version.

Impact Analysis

The vulnerability could cause crashes or unexpected behavior in Apache Traffic Server due to memory corruption. It may lead to denial-of-service conditions or potential data processing issues.

Compliance Impact

This vulnerability causes memory corruption due to integer mishandling in header decoding, which could lead to denial of service or potential data exposure. Such issues may impact compliance with GDPR by risking data integrity or availability, and with HIPAA by potentially exposing protected health information if service disruption occurs.

Mitigation Strategies

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 immediately. If using a package manager, run commands like 'apt upgrade apache2' or 'yum update trafficserver' depending on your system. Ensure backups are taken before upgrading.

Hi! I’m here to help you understand CVE-2026-58152. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70