CVE-2026-58182

Analyzed Analyzed - Analysis Complete

Memory Corruption in Apache Traffic Server ts_lua Plugin

Publication date: 2026-07-29

Last updated on: 2026-07-31

Assigner: Apache Software Foundation

Description

The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-31

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-58182

Affected Vendors & Products

Vendor	Product	Version / Range
apache	traffic_server	From 10.0.0 (inc) to 10.1.4 (exc)
apache	traffic_server	From 8.0.0 (inc) to 8.1.9 (inc)
apache	traffic_server	From 9.0.0 (inc) to 9.2.15 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

The Apache Traffic Server ts_lua plugin has a flaw in how it handles initialization, transform context, and per-instance state. This can lead to improper processing and potential security issues during plugin operations.

Detection Guidance

Detection involves checking Apache Traffic Server versions affected by CVE-2026-58182. Use commands like 'traffic_server -v' or 'apt list --installed | grep trafficserver' to verify installed versions. Compare against vulnerable ranges (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3).

Inspect ts_lua plugin usage in configuration files (e.g., 'grep -r ts_lua /etc/trafficserver/'). Monitor for crashes or errors in logs during Lua script execution.

Impact Analysis

This vulnerability could allow attackers to execute arbitrary code, cause denial of service, or bypass security mechanisms if exploited. Systems running affected versions of Apache Traffic Server are at risk.

Compliance Impact

The vulnerability in Apache Traffic Server's ts_lua plugin could potentially lead to unauthorized access or data leakage due to improper state handling. This may impact compliance with GDPR (data protection) and HIPAA (health data security) by increasing risks of data breaches or unauthorized modifications.

Mitigation Strategies

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 or later to fix the issue.

Hi! I’m here to help you understand CVE-2026-58182. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70