Apache Traffic Server CVE-2026-58154

Exploitation requires sending crafted MIME/HTTP headers to a reachable Apache Traffic Server instance running an affected version (8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3); no authentication or user interaction is needed (PR:N/UI:N), so any party able to route requests through the proxy - or an origin whose responses ATS parses - can reach the vulnerable header-parsing path. The principal limiting factor is high attack complexity (AC:H): reliably triggering the integer overflow and out-of-bounds write depends on precise header construction and favorable memory conditions rather than a single trivially reproducible request, which lowers the odds of opportunistic mass exploitation versus a determined attacker.

The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H describes a network-reachable, unauthenticated bug (PR:N/UI:N) with high attack complexity (AC:H), consistent with needing precisely crafted headers and favorable heap/integer conditions to reliably trigger the overflow rather than a trivial one-shot. Scope is Changed (S:C), reflecting that a compromised proxy can affect backends and other clients beyond ATS itself; impact is high to integrity and availability (I:H/A:H) with limited confidentiality (C:L), which fits memory corruption that most readily crashes the service or corrupts state. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so real-world exploitation signal is currently absent - the risk driver here is the intrinsic severity of a remotely reachable OOB write in edge infrastructure, not observed exploitation. The AC:H rating tempers urgency somewhat, but given ATS's exposed, high-throughput role, this should be treated as a genuine priority rather than a high-CVSS-but-low-real-risk issue.

A remote attacker sends a specially crafted HTTP request with malformed or boundary-value MIME/header fields to an ATS instance (or, in reverse-proxy mode, induces a crafted origin response through it), triggering the integer overflow and out-of-bounds write during header parsing. Given AC:H, the attacker likely iterates over header sizes and values to reliably corrupt memory, most plausibly crashing the proxy (denial of service) or corrupting request state. No public exploit is identified at time of analysis.