Apache Traffic Server CVE-2026-58152

Exploitation requires Apache Traffic Server to be running a vulnerable version (8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3) with HTTP/2 or HTTP/3 (QUIC) protocol support enabled and accessible from the attacker's network position. The CVSS AC:H rating indicates that the attacker must craft a specific malformed integer sequence within HPACK/XPACK header encoding - a generic or randomly malformed request is unlikely to trigger the overflow. No authentication is required (PR:N), and no user interaction is needed (UI:N). Exploitation is limited to denial of service; the CVSS C:N/I:N metrics confirm no confidentiality or integrity impact is expected. Deployments that terminate HTTP/2 at an upstream load balancer or reverse proxy before reaching ATS may have reduced exposure if that intermediary validates or re-encodes HPACK headers.

The CVSS 3.1 base score of 5.9 (Medium) is consistent with the available signals. The AV:N metric confirms the attack surface is network-reachable without special positioning, but AC:H substantially reduces real-world risk by requiring the attacker to engineer a precisely malformed integer encoding in HPACK/XPACK headers - automated scanning tools are unlikely to trigger this reliably. PR:N means no credentials are needed, which broadens the potential attacker pool. The impact metrics C:N/I:N/A:H constrain the worst-case outcome to a service crash, with no data exfiltration or integrity compromise. This vulnerability is not listed in CISA KEV, no public proof-of-concept has been identified, and no EPSS data was available in the provided intelligence - all consistent with a moderate, not yet actively targeted issue. Notably, the advisory tags include 'Information Disclosure', which directly conflicts with the CVSS C:N rating; this tag appears to be erroneous, and the CVSS vector is treated as authoritative. The primary real-world risk is availability disruption to any service fronted by a vulnerable ATS instance, particularly relevant for CDN and reverse-proxy operators. Given the AC:H rating, this is a real but not urgent priority unless the deployment is exposed to untrusted HTTP/2 or HTTP/3 traffic at scale.

An unauthenticated attacker sends a crafted HTTP/2 request containing a malformed HPACK header block in which an integer field is encoded to produce an overflow when decoded by Apache Traffic Server. The corrupted integer propagates into memory allocation or buffer indexing logic, corrupting the ATS process heap and causing a crash, taking down the proxy or cache service. No public exploit code has been identified at time of analysis, and the AC:H rating indicates successful triggering requires precise crafting of the integer encoding.