CVE-2026-58183

Received Received - Intake

Denial of Service in Apache Traffic Server

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: Apache Software Foundation

Description

The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-58183

Affected Vendors & Products

Vendor	Product	Version / Range
apache	traffic_server	From 8.0.0 (inc) to 8.1.9 (inc)
apache	traffic_server	From 9.0.0 (inc) to 9.2.14 (inc)
apache	traffic_server	From 10.0.0 (inc) to 10.1.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

The Apache Traffic Server prefetch plugin crashes when processing specially crafted input from an attacker. This is a denial-of-service risk where malformed requests cause the server to fail.

Detection Guidance

Detecting this vulnerability requires checking the Apache Traffic Server version. Run: apache-traffic-server -v or check package versions (e.g., rpm -qa | grep trafficserver or dpkg -l | grep trafficserver). If running versions 8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3, the system is vulnerable.

Impact Analysis

If exploited, this flaw could disrupt Apache Traffic Server operations, leading to service outages or degraded performance for users relying on the server.

Mitigation Strategies

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 immediately. If upgrading is not possible, disable the prefetch plugin or restrict input processing to trusted sources until patched.

Hi! I’m here to help you understand CVE-2026-58183. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70