Which versions of Apache Traffic Server are affected by CVE-2026-58155?

Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 contain a request smuggling vulnerability (CVSS 9.3) that enables attackers to bypass critical…

How to fix or mitigate CVE-2026-58155?

Within 24 hours, conduct a complete inventory of Apache Traffic Server deployments and identify instances running the affected versions-8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3-and assess their criticality and network exposure. Within 7 days, implement compensating controls: deploy Web Application Firewall (WAF) rules to block HTTP requests containing oversized header names, activate strict header name validation and length enforcement on all downstream systems consuming Traffic Server responses, and restrict network access to affected Traffic Server instances through firewall rules permitting only connections from trusted, authenticated sources. Within 30 days, establish continuous monitoring of vendor security advisories for patch availability; evaluate alternative proxy solutions or temporary traffic rerouting to reduce exposure on unpatched instances; develop and communicate a formal remediation timeline to stakeholders.

Apache Traffic Server CVE-2026-58155

Q: What is the CVSS score of CVE-2026-58155?

CVE-2026-58155 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-50209 CRITICAL

HTTP Request/Response Smuggling (CWE-444)

2026-07-29 apache

GHSA-9jfm-2xhc-ghxj

Authentication Bypass Apache Request Smuggling Apache Traffic Server Apache Software Foundation

9.2

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

9.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.3 CRITICAL

Remote unauthenticated HTTP request (AV:N/AC:L/PR:N/UI:N); smuggling crosses the proxy trust boundary (S:C) with high integrity impact from policy bypass and limited confidentiality exposure, no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 29, 2026 - 09:22 NVD

HIGH CRITICAL

CVSS changed

Jul 29, 2026 - 09:22 NVD

9.3 (HIGH) 9.2 (CRITICAL)

Analysis Generated

Jul 29, 2026 - 08:51 vuln.today

CVE Published

Jul 29, 2026 - 08:24 cve.org

HIGH 9.3

DescriptionCVE.org

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Articles & Coverage 1

News Critical HTTP Request Smuggling in Apache Traffic Server - CVE-2026-58155 Jul 30, 2026

AnalysisAI

Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises because the proxy silently truncates over-long HTTP header names, causing two distinct header names to alias to the same value. A network attacker can exploit this desynchronization to smuggle requests past the proxy and bypass security or routing policy. No public exploit has been identified at time of analysis, but the CVSS 9.3 rating and CWE-444 classification mark this as a high-priority proxy integrity flaw affecting a core CDN/caching component.

Technical ContextAI

Apache Traffic Server is a high-performance forward and reverse HTTP/HTTPS caching proxy widely used as CDN edge and origin-shield infrastructure. The root cause is CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling): when a header name exceeds the parser's length limit, ATS truncates the name rather than rejecting the message, so distinct headers collapse to the same effective name ('header aliasing'). Because ATS and its upstream/downstream endpoints then disagree about which header value applies, request boundaries and security-relevant headers (e.g., routing, auth, or filtering headers) can be reinterpreted. The single CPE (cpe:2.3:a:apache_software_foundation:apache_traffic_server:*) confirms the affected product is the ATS proxy itself, not a bundled library.

RemediationAI

Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 9.x branch) or 10.1.4 (for the 10.x branch), per the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. Users on the affected 8.0.0-8.1.9 branch have no listed 8.x fixed release and should migrate to 9.2.15 or 10.1.4. As a compensating control until patching, place a strict HTTP header-validation layer in front of ATS (e.g., a WAF or upstream proxy) configured to reject requests containing abnormally long header names rather than truncating them, and disable HTTP connection reuse/keep-alive to origins where feasible to reduce smuggling opportunity - noting this reduces throughput and increases origin connection load. Restricting who can reach the proxy does not mitigate this, since the attack is unauthenticated over the normal HTTP path.