CVE-2026-58184

Analyzed Analyzed - Analysis Complete

Memory Corruption in Apache Traffic Server

Publication date: 2026-07-29

Last updated on: 2026-07-31

Assigner: Apache Software Foundation

Description

The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-31

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-58184

Affected Vendors & Products

Vendor	Product	Version / Range
apache	traffic_server	From 10.0.0 (inc) to 10.1.4 (exc)
apache	traffic_server	From 8.0.0 (inc) to 8.1.9 (inc)
apache	traffic_server	From 9.0.0 (inc) to 9.2.15 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

The Apache Traffic Server header_rewrite plugin has a flaw where it can crash or corrupt memory during cookie operations and CIDR condition matching. This affects versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

Detection Guidance

This vulnerability affects Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. To detect it, check your Apache Traffic Server version using commands like 'traffic_server -v' or 'apachectl -v'. If your version falls within the affected ranges, the system is vulnerable.

Impact Analysis

This vulnerability could lead to denial of service due to crashes or memory corruption. Attackers might exploit it to disrupt Apache Traffic Server operations, potentially causing service outages or instability.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by causing service disruptions or data corruption during cookie operations and CIDR matching. Memory corruption or crashes may lead to unauthorized data access or loss of integrity, which are key concerns under these regulations.

Mitigation Strategies

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 immediately. These versions contain fixes for the header_rewrite plugin issues. Follow standard upgrade procedures for your installation method (e.g., package manager or source compilation).

Hi! I’m here to help you understand CVE-2026-58184. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70