CVE-2026-58181

Analyzed Analyzed - Analysis Complete

Stack Overflow in Apache Traffic Server

Publication date: 2026-07-29

Last updated on: 2026-07-31

Assigner: Apache Software Foundation

Description

The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-31

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-58181

Affected Vendors & Products

Vendor	Product	Version / Range
apache	traffic_server	From 10.0.0 (inc) to 10.1.4 (exc)
apache	traffic_server	From 8.0.0 (inc) to 8.1.9 (inc)
apache	traffic_server	From 9.0.0 (inc) to 9.2.15 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash when processing attacker-controlled input. This occurs in versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

Detection Guidance

This vulnerability can be detected by checking the version of Apache Traffic Server running on your system. If it falls within the affected versions (8.0.0 through 8.1.9, 9.0.0 through 9.2.14, or 10.0.0 through 10.1.3), it is vulnerable. Use commands like 'traffic_server -v' or check package managers (e.g., 'rpm -qa | grep trafficserver' or 'dpkg -l | grep trafficserver').

Impact Analysis

This vulnerability can cause denial of service by crashing Apache Traffic Server, leading to service disruption. Attackers may exploit it to make the system unavailable.

Compliance Impact

This vulnerability causes stack exhaustion or crashes in Apache Traffic Server plugins, leading to denial-of-service conditions. While not directly violating GDPR or HIPAA, such disruptions could impact availability of systems handling personal or health data, potentially violating compliance requirements for data accessibility and security.

Mitigation Strategies

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 immediately. If upgrading is not possible, disable the uri_signing and url_sig plugins until the upgrade is completed.

Hi! I’m here to help you understand CVE-2026-58181. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70