CVE-2026-58178

Analyzed Analyzed - Analysis Complete

Unbounded Recursion in Apache Traffic Server ESI Plugin

Publication date: 2026-07-29

Last updated on: 2026-07-31

Assigner: Apache Software Foundation

Description

The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-31

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-58178

Affected Vendors & Products

Vendor	Product	Version / Range
apache	traffic_server	From 10.0.0 (inc) to 10.1.4 (exc)
apache	traffic_server	From 8.0.0 (inc) to 8.1.9 (inc)
apache	traffic_server	From 9.0.0 (inc) to 9.2.15 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

The Apache Traffic Server ESI plugin has a flaw where it can recursively fetch URLs without proper limits. This allows an attacker to force the server to make an unbounded number of requests to arbitrary URLs controlled by the attacker.

Detection Guidance

Detecting this vulnerability requires checking Apache Traffic Server versions affected by CVE-2026-58178. Use commands like 'traffic_server -v' or check package managers (e.g., 'rpm -qa | grep trafficserver' or 'dpkg -l | grep trafficserver') to identify installed versions. Compare against vulnerable ranges: 8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3.

Impact Analysis

This vulnerability can lead to denial-of-service conditions by overwhelming the server with excessive requests. It may also expose internal systems if attacker-controlled URLs point to internal resources.

Compliance Impact

This vulnerability allows unbounded recursion and fetching of attacker-controlled URLs, which could lead to unauthorized data exfiltration or manipulation. This may violate GDPR's data protection principles (Article 5) and HIPAA's integrity and confidentiality requirements if exploited.

Mitigation Strategies

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 or later to address the unbounded recursion in the ESI plugin.

Hi! I’m here to help you understand CVE-2026-58178. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70