CVE-2026-58163

Analyzed Analyzed - Analysis Complete

Apache Traffic Server Cache Corruption Vulnerability

Publication date: 2026-07-29

Last updated on: 2026-08-03

Assigner: Apache Software Foundation

Description

Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-03

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-58163

Affected Vendors & Products

Vendor	Product	Version / Range
apache	traffic_server	From 10.0.0 (inc) to 10.1.4 (exc)
apache	traffic_server	From 8.0.0 (inc) to 8.1.9 (inc)
apache	traffic_server	From 9.0.0 (inc) to 9.2.15 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

Apache Traffic Server has a flaw where it mishandles on-disk cache fields and object lifetimes. This can lead to corrupted state or crashes in the software.

Detection Guidance

This vulnerability involves Apache Traffic Server mishandling cache fields and object lifetimes, which can corrupt state or crash the system. Detection primarily involves checking the Apache Traffic Server version and monitoring for crashes or corruption.

Impact Analysis

This vulnerability could cause Apache Traffic Server to crash or behave unpredictably, potentially disrupting services relying on it. It may also lead to data corruption in cached objects.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to Apache Traffic Server's cache handling. However, if the crash or corruption leads to data integrity issues or unauthorized access, it could indirectly impact compliance by compromising data protection requirements.

Mitigation Strategies

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4, as these versions fix the issue. The vulnerability affects versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

Hi! I’m here to help you understand CVE-2026-58163. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70