CVE-2026-58186

Analyzed Analyzed - Analysis Complete

Incorrect WebP Response Handling in Apache Traffic Server

Publication date: 2026-07-29

Last updated on: 2026-07-31

Assigner: Apache Software Foundation

Description

The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-31

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-58186

Affected Vendors & Products

Vendor	Product	Version / Range
apache	traffic_server	From 10.0.0 (inc) to 10.1.4 (exc)
apache	traffic_server	From 8.0.0 (inc) to 8.1.9 (inc)
apache	traffic_server	From 9.0.0 (inc) to 9.2.15 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

The Apache Traffic Server webp_transform plugin can decode images unsafely and serve mislabeled responses that are cacheable. This may lead to incorrect content being delivered to users.

Detection Guidance

Detection involves checking Apache Traffic Server versions affected by this vulnerability. Run: apachectl -v or traffic_server -v to check the installed version. If the version falls within 8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3, the system is vulnerable.

Impact Analysis

This vulnerability could allow attackers to serve malicious or incorrect content to users, potentially leading to data breaches, misinformation, or service disruptions. Users relying on cached content may receive unsafe or outdated responses.

Compliance Impact

The vulnerability involves unsafe decoding and serving of mislabeled, cacheable responses in Apache Traffic Server. This could potentially lead to unauthorized data exposure or integrity issues, which may impact compliance with standards like GDPR (data protection) and HIPAA (healthcare data privacy). However, specific compliance impacts are not detailed in the provided context.

Mitigation Strategies

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 immediately. Disable the webp_transform plugin if an upgrade is not immediately possible. Monitor for unusual traffic patterns or cacheable responses.

Hi! I’m here to help you understand CVE-2026-58186. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70