CVE-2026-58163
Received
Received - Intake
Apache Traffic Server Cache Corruption Vulnerability
Vulnerability report for CVE-2026-58163, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-07-29
Last updated on: 2026-07-29
Assigner: Apache Software Foundation
Description
Description
Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | traffic_server | From 8.0.0 (inc) to 8.1.9 (inc) |
| apache | traffic_server | From 9.0.0 (inc) to 9.2.14 (inc) |
| apache | traffic_server | From 10.0.0 (inc) to 10.1.3 (inc) |
| apache | traffic_server | 9.2.15 |
| apache | traffic_server | 10.1.4 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
