Apache Traffic Server CVE-2026-58151

Exploitation requires that the targeted Apache Traffic Server instance has HTTP/2 enabled on a network-reachable listener (HTTP/2 is a standard client-facing configuration for ATS as an edge/reverse proxy). Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no user interaction, and no special attack requirements are needed against affected versions (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3). The primary limiting factor is that HTTP/2 must be in use on the reachable interface; instances serving only HTTP/1.1 or with the affected listener firewalled off are not exposed. Impact is limited to availability - the attack cannot read or alter data or execute code.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and the impact is confined to availability (VA:H; VC:N/VI:N/VA:H with no confidentiality or integrity loss and no scope change), which is consistent with the described DoS/resource-exhaustion behavior and yields the 8.7 score. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation likelihood cannot be quantified from the input; the absence of KEV means there is no confirmed active exploitation and no public exploit was identified at time of analysis. Because ATS is typically an internet-facing edge proxy, the low-effort unauthenticated nature makes this a credible operational availability risk despite the lack of confidentiality/integrity impact - prioritize patching for externally exposed instances, but note this is a DoS rather than a compromise-class issue.

An attacker points a scripted HTTP/2 client at an internet-facing ATS proxy and opens a connection, then sends a stream of abusive frames and flow-control updates (e.g., rapid stream churn or window manipulation) that force the server into excessive resource consumption. Because no authentication or user interaction is required and complexity is low, a single host or small botnet can drive the proxy to crash or unresponsiveness, denying service to legitimate clients. No public exploit was identified at time of analysis.