CVE-2026-58154

Analyzed Analyzed - Analysis Complete

Integer Overflow in Apache Traffic Server MIME Header Parsing

Publication date: 2026-07-29

Last updated on: 2026-08-03

Assigner: Apache Software Foundation

Description

Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-03

Generated

2026-08-18

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-17

NVD

CVE-2026-58154

EUVD

EUVD-2026-50208

Affected Vendors & Products

Vendor	Product	Version / Range
apache	traffic_server	From 10.0.0 (inc) to 10.1.4 (exc)
apache	traffic_server	From 8.0.0 (inc) to 8.1.9 (inc)
apache	traffic_server	From 9.0.0 (inc) to 9.2.15 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

Apache Traffic Server has a vulnerability where it can write out of bounds or overflow integers while parsing MIME and HTTP headers. This occurs in versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

Detection Guidance

This vulnerability involves out-of-bounds writes or integer overflows in Apache Traffic Server while parsing MIME and HTTP headers. Detection requires checking the version of Apache Traffic Server running on your system. Use commands like 'traffic_server -v' or 'httpd -v' to verify the version. If your version falls within 8.0.0 to 8.1.9, 9.0.0 to 9.2.14, or 10.0.0 to 10.1.3, your system is vulnerable.

Impact Analysis

This vulnerability could allow attackers to execute arbitrary code, cause denial of service, or gain unauthorized access to systems running affected versions of Apache Traffic Server.

Compliance Impact

This vulnerability involves out-of-bounds writes or integer overflows while parsing MIME and HTTP headers in Apache Traffic Server. Such flaws could potentially lead to data corruption, unauthorized access, or denial of service, which may impact compliance with standards like GDPR (data integrity) or HIPAA (availability and integrity of protected health information).

Mitigation Strategies

Immediately upgrade Apache Traffic Server to version 9.2.15 or 10.1.4, as these versions contain fixes for the vulnerability. If upgrading is not immediately possible, consider temporarily disabling the service or restricting network access to it until the upgrade is completed.

Hi! I’m here to help you understand CVE-2026-58154. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70