Skip to main content

Apache Traffic Server CVE-2026-58155

| EUVDEUVD-2026-50209 CRITICAL
HTTP Request/Response Smuggling (CWE-444)
2026-07-29 apache GHSA-9jfm-2xhc-ghxj
Authentication Bypass Apache Request Smuggling Apache Traffic Server
9.2
CVSS 4.0 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
9.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.3 CRITICAL

Remote unauthenticated HTTP request (AV:N/AC:L/PR:N/UI:N); smuggling crosses the proxy trust boundary (S:C) with high integrity impact from policy bypass and limited confidentiality exposure, no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Severity Changed
Jul 29, 2026 - 09:22 NVD
HIGH CRITICAL
CVSS changed
Jul 29, 2026 - 09:22 NVD
9.3 (HIGH) 9.2 (CRITICAL)
Analysis Generated
Jul 29, 2026 - 08:51 vuln.today
CVE Published
Jul 29, 2026 - 08:24 cve.org
HIGH 9.3

DescriptionCVE.org

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Articles & Coverage 1

News Critical HTTP Request Smuggling in Apache Traffic Server - CVE-2026-58155 Jul 30, 2026

AnalysisAI

Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises because the proxy silently truncates over-long HTTP header names, causing two distinct header names to alias to the same value. A network attacker can exploit this desynchronization to smuggle requests past the proxy and bypass security or routing policy. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach ATS over HTTP
Delivery
Craft over-long aliasing header
Exploit
Truncation collapses header names
Execution
Desync proxy and backend
Persist
Smuggle request or override policy header
Impact
Bypass access/routing controls
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the ability to send HTTP requests through an Apache Traffic Server proxy running an affected version (8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3), and the crafted request must include a header name long enough to trigger ATS's truncation-instead-of-rejection behavior so that it aliases another header. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N, score 9.3) indicates a remotely reachable, low-complexity, unauthenticated attack with a scope change - consistent with smuggling that crosses the trust boundary from proxy to backend, hence the high integrity impact and the scope flag. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker sends a crafted HTTP request containing a header whose name exceeds ATS's length limit so that, after truncation, it aliases a security-relevant header the proxy trusts. The desynchronized interpretation between ATS and the backend lets the attacker smuggle a second request or override a policy header, bypassing access controls or cache/routing rules. …
Remediation Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 9.x branch) or 10.1.4 (for the 10.x branch), per the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, conduct a complete inventory of Apache Traffic Server deployments and identify instances running the affected versions-8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3-and assess their criticality and network exposure. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Apache Traffic Server

View all
CVE-2026-58161 CRITICAL
9.2 Jul 29

Remote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
CVE-2026-58154 CRITICAL
9.2 Jul 29

Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
CVE-2026-58151 HIGH
8.7 Jul 29

Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
CVE-2026-58188 HIGH
8.4 Jul 29

Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
CVE-2026-58162 HIGH
8.4 Jul 29

Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
CVE-2026-58164 HIGH
8.3 Jul 29

Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
CVE-2026-58163 HIGH
8.3 Jul 29

Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
CVE-2026-58184 HIGH
8.3 Jul 29

Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy
CVE-2026-58177 HIGH
8.3 Jul 29

Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows rem
CVE-2026-58180 HIGH
8.2 Jul 29

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-b
CVE-2026-58178 HIGH
8.2 Jul 29

Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers t
CVE-2026-58175 HIGH
8.2 Jul 29

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a memory

Same weakness CWE-444 – HTTP Request/Response Smuggling

View all
CVE-2018-3907 CRITICAL POC
10.0
CVE-2023-41265 CRITICAL POC
9.9
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8
CVE-2020-7611 CRITICAL POC
9.8
CVE-2020-10109 CRITICAL POC
9.8
CVE-2020-10108 CRITICAL POC
9.8
CVE-2021-38162 CRITICAL POC
9.4

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2026-58155 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy