Which versions of Apache Traffic Server are affected by CVE-2026-58151?

Apache Traffic Server versions 8.0.0 through 10.1.3 contain a remote denial-of-service vulnerability that allows unauthenticated attackers to crash proxy infrastructure or exhaust resources via…

How to fix or mitigate CVE-2026-58151?

Within 24 hours, complete a full inventory of Apache Traffic Server deployments and identify all instances running versions 8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3. Within 7 days, apply vendor-released patches to upgrade version 9.x deployments to 9.2.15 and version 10.x deployments to 10.1.4 on all production and critical staging systems; implement rate-limiting rules on network ingress to throttle suspicious HTTP/2 framing patterns as an interim control during rollout. Within 30 days, complete patching of all remaining Apache Traffic Server instances across non-production environments and validate patch deployment by confirming version compliance across the infrastructure estate.

Apache Traffic Server CVE-2026-58151

Q: What is the CVSS score of CVE-2026-58151?

CVE-2026-58151 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-50203 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-29 apache

GHSA-fvmr-rjj2-5pq8

Denial Of Service Apache Apache Traffic Server Apache Software Foundation

8.7

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote, low-complexity, unauthenticated HTTP/2 abuse with no user interaction; impact is denial of service only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 09:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 09:22 vuln.today

cvss_changed

CVSS changed

Jul 29, 2026 - 09:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

Jul 29, 2026 - 08:52 vuln.today

CVE Published

Jul 29, 2026 - 08:15 cve.org

HIGH 7.5

DescriptionCVE.org

Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

AnalysisAI

Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated attackers crash the proxy or exhaust its resources by sending abusive HTTP/2 framing and flow-control sequences. The flaw is availability-only (no data disclosure or code execution), carries a CVSS 4.0 base score of 8.7, and has no public exploit identified at time of analysis. The Apache HTTP Server project has released fixed builds (9.2.15 and 10.1.4).

Technical ContextAI

Apache Traffic Server (ATS) is a widely deployed high-performance caching forward and reverse proxy that terminates client connections and supports HTTP/2. HTTP/2 multiplexes many logical streams over a single TCP connection and relies on frame-based signaling (HEADERS, DATA, SETTINGS, WINDOW_UPDATE, RST_STREAM, PING) plus per-stream and per-connection flow-control windows to regulate data. This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption): malformed or abusive framing and flow-control manipulation cause ATS to consume excessive CPU/memory or hit a fault condition, mirroring the well-known class of HTTP/2 abuse issues (e.g., rapid-reset and flow-control flooding) where cheap-to-send client frames force disproportionate server-side work. The single wildcard CPE (cpe:2.3:a:apache_software_foundation:apache_traffic_server) indicates all ATS packages in the listed version ranges are affected regardless of platform.

RemediationAI

Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 9.x line) or 10.1.4 (for the 10.x line), per the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d; note that no fixed version is listed for the 8.x line, so operators still on 8.0.0-8.1.9 should migrate to a supported patched release. Where immediate patching is not possible, reduce exposure by restricting or disabling HTTP/2 on client-facing listeners (falling back to HTTP/1.1 removes the affected framing/flow-control surface at the cost of HTTP/2 multiplexing performance), tightening HTTP/2 limits such as maximum concurrent streams and connection/frame rate limits if configurable in your ATS build, and placing rate-limiting or a WAF/upstream load balancer in front of edge instances to throttle abusive connections. These controls degrade throughput or add latency and are stopgaps only; upgrading is the reliable fix.