CVE-2026-58175

Analyzed Analyzed - Analysis Complete

Memory Leak in Apache Traffic Server

Publication date: 2026-07-29

Last updated on: 2026-07-31

Assigner: Apache Software Foundation

Description

Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-31

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-58175

Affected Vendors & Products

Vendor	Product	Version / Range
apache	traffic_server	From 10.0.0 (inc) to 10.1.4 (exc)
apache	traffic_server	From 8.0.0 (inc) to 8.1.9 (inc)
apache	traffic_server	From 9.0.0 (inc) to 9.2.15 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

Apache Traffic Server has a memory leak issue when processing HostDB SRV records. This flaw affects versions from 8.0.0 to 8.1.9, 9.0.0 to 9.2.14, and 10.0.0 to 10.1.3. The vulnerability allows memory to be leaked during normal operations.

Detection Guidance

This vulnerability involves memory leaks in Apache Traffic Server when handling HostDB SRV records. Detection requires monitoring memory usage and traffic patterns on systems running affected versions. Check Apache Traffic Server logs for unusual memory consumption or crashes. Use system monitoring tools like top, htop, or ps to observe memory usage of the traffic_server process. If memory usage grows abnormally under SRV record processing, the system may be affected.

Impact Analysis

The memory leak could lead to degraded performance or eventual crashes of the Apache Traffic Server due to excessive memory consumption. This may cause service disruptions for applications relying on the server.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a memory leak issue in Apache Traffic Server. However, memory leaks could indirectly impact system availability and performance, which may lead to compliance risks if they cause service disruptions or data processing delays.

Mitigation Strategies

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 or later to fix the memory leak issue in HostDB SRV record handling.

Hi! I’m here to help you understand CVE-2026-58175. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70