Which versions of Apache Traffic Server are affected by CVE-2026-58154?

Apache Traffic Server versions 8.x through 10.1.3 contain a critical memory corruption vulnerability (CVSS 8.9) in header parsing that allows remote attackers to corrupt proxy memory through crafted…

How to fix or mitigate CVE-2026-58154?

Within 24 hours, identify all Apache Traffic Server instances in production environments and document their version numbers against the affected ranges (8.x, 9.x through 9.2.14, 10.x through 10.1.3). Within 7 days, implement network-layer mitigations by deploying WAF rules to detect and block oversized or malformed MIME/HTTP headers, enable rate limiting on header-intensive requests, and restrict direct inbound access to proxy ports where feasible through segmentation. Within 30 days, establish daily monitoring of Apache Traffic Server and CISA advisories for patch release notices, prepare pre-tested deployment procedures for an emergency patch release, and document rollback procedures for immediate application once a vendor fix becomes available.

Apache Traffic Server CVE-2026-58154

Q: What is the CVSS score of CVE-2026-58154?

CVE-2026-58154 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-50208 CRITICAL

Out-of-bounds Write (CWE-787)

2026-07-29 apache

GHSA-pfrm-2m3q-3pcv

Buffer Overflow Apache Memory Corruption Apache Traffic Server Apache Software Foundation

9.2

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

9.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.9 HIGH

Remote unauthenticated header parsing (AV:N/PR:N/UI:N), but crafted-input and memory conditions justify AC:H; proxy compromise reaches backends so S:C, with memory corruption yielding I:H/A:H and limited C:L.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 29, 2026 - 09:22 NVD

HIGH CRITICAL

CVSS changed

Jul 29, 2026 - 09:22 NVD

8.9 (HIGH) 9.2 (CRITICAL)

Analysis Generated

Jul 29, 2026 - 08:52 vuln.today

CVE Published

Jul 29, 2026 - 08:24 cve.org

HIGH 8.9

DescriptionCVE.org

Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Articles & Coverage 1

News Critical Memory Corruption RCE in Apache Traffic Server - CVE-2026-58154 Jul 30, 2026

AnalysisAI

Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers corrupt memory by sending crafted headers to the proxy. It affects the 8.x, 9.x (through 9.2.14) and 10.x (through 10.1.3) branches, carries a high CVSS of 8.9 with a scope-change flag, and can lead to high integrity and availability impact. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the memory-corruption class makes it a strong patching priority.

Technical ContextAI

Apache Traffic Server (ATS) is a high-performance forward and reverse caching HTTP proxy deployed at CDN and edge scale. The flaw sits in its MIME/HTTP header parsing code, which handles attacker-controllable request and response header fields. The root cause is CWE-787 (Out-of-bounds Write): during parsing, integer arithmetic on header lengths or offsets can overflow, producing an incorrect size or index that drives a write past allocated buffer bounds. Because ATS terminates and reconstructs HTTP messages, any client - or, in reverse-proxy mode, any origin whose responses transit ATS - can steer the parser's inputs, making the header path a directly reachable attack surface.

RemediationAI

Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 9.x line) or 10.1.4 (for the 10.x line) as published in the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. Because the 8.x branch (8.0.0-8.1.9) is affected but end-of-life with no fixed 8.x release named, operators still on 8.x should migrate to a fixed 9.2.15 or 10.1.4 build rather than expecting a backport. Where immediate patching is not possible, place a hardened HTTP filter in front of ATS to reject malformed or abnormally large header sets, tighten proxy request/response header size and count limits, and restrict who can reach the proxy at the network layer; note these are only partial compensating controls, since the defect is in ATS's own parser and legitimate-looking crafted headers may still pass upstream filters, so upgrading remains the reliable fix.