CVE-2026-58175
Received
Received - Intake
Memory Leak in Apache Traffic Server
Vulnerability report for CVE-2026-58175, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-07-29
Last updated on: 2026-07-29
Assigner: Apache Software Foundation
Description
Description
Apache Traffic Server leaks memory when handling HostDB SRV records.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | traffic_server | From 8.0.0 (inc) to 8.1.9 (inc) |
| apache | traffic_server | From 9.0.0 (inc) to 9.2.14 (inc) |
| apache | traffic_server | From 10.0.0 (inc) to 10.1.3 (inc) |
| apache | traffic_server | 9.2.15 |
| apache | traffic_server | 10.1.4 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
