CVE-2026-58158
Received
Received - Intake
Stack Overflow in Apache Traffic Server
Vulnerability report for CVE-2026-58158, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-07-29
Last updated on: 2026-07-29
Assigner: Apache Software Foundation
Description
Description
Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | traffic_server | From 8.0.0 (inc) to 8.1.9 (inc) |
| apache | traffic_server | From 9.0.0 (inc) to 9.2.14 (inc) |
| apache | traffic_server | From 10.0.0 (inc) to 10.1.3 (inc) |
| apache | traffic_server | 9.2.15 |
| apache | traffic_server | 10.1.4 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
