CVE-2026-58187

Analyzed Analyzed - Analysis Complete

Denial of Service in Apache Traffic Server

Publication date: 2026-07-29

Last updated on: 2026-07-31

Assigner: Apache Software Foundation

Description

The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-31

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-58187

Affected Vendors & Products

Vendor	Product	Version / Range
apache	traffic_server	From 10.0.0 (inc) to 10.1.4 (exc)
apache	traffic_server	From 8.0.0 (inc) to 8.1.9 (inc)
apache	traffic_server	From 9.0.0 (inc) to 9.2.15 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability involves a buffer overrun in the Apache Traffic Server multiplexer plugin when processing upstream input. This flaw allows an attacker to cause a denial of service by crashing the server.

Detection Guidance

Detection requires monitoring Apache Traffic Server logs for crashes or errors related to chunk-decode buffer overruns. Check for upstream input anomalies or service interruptions. No specific commands are provided in the CVE details.

Impact Analysis

The vulnerability can lead to service disruption as the Apache Traffic Server crashes due to the buffer overrun. This may cause downtime for web services relying on the server.

Compliance Impact

This vulnerability is a denial of service issue in Apache Traffic Server, which could disrupt service availability. While it does not directly impact data confidentiality or integrity, prolonged downtime could affect compliance with standards requiring continuous availability, such as certain aspects of GDPR or HIPAA. However, no specific compliance impact is detailed in the provided context.

Mitigation Strategies

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 or later to fix the buffer overrun issue.
Monitor network traffic for unusual patterns that may indicate exploitation attempts targeting the multiplexer plugin.

Hi! I’m here to help you understand CVE-2026-58187. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70