Which versions of Apache Traffic Server are affected by CVE-2026-58157?

Apache Traffic Server versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 contain a data leakage vulnerability where one client can receive confidential information intended for another client on…

How to fix or mitigate CVE-2026-58157?

Within 24 hours, conduct a complete inventory of infrastructure to identify all Apache Traffic Server deployments and confirm whether any instance runs versions 8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3. Within 7 days, if immediate upgrading is not feasible, implement network segmentation to isolate affected proxy tiers from untrusted client networks and deploy enhanced monitoring to detect anomalous cross-client response patterns in access logs. Within 30 days, upgrade all affected instances to Apache Traffic Server 8.2.0+, 9.3.0+, or 10.2.0+ respectively, or decommission affected proxies in favor of verified non-vulnerable proxy infrastructure.

Apache Traffic Server CVE-2026-58157

Q: What is the CVSS score of CVE-2026-58157?

CVE-2026-58157 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-50210 MEDIUM

Information Exposure (CWE-200)

2026-07-29 apache

GHSA-vc32-c93g-p2f6

Apache Information Disclosure Apache Traffic Server Apache Software Foundation

6.9

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

6.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote unauthenticated (PR:N) but timing-dependent session reuse gives AC:H; cross-connection data leak is scope-changed and confidentiality-critical (C:H), with only incidental integrity (I:L) and no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 29, 2026 - 10:22 NVD

HIGH MEDIUM

CVSS changed

Jul 29, 2026 - 10:22 NVD

8.7 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Jul 29, 2026 - 09:52 vuln.today

CVE Published

Jul 29, 2026 - 08:25 cve.org

HIGH 8.7

DescriptionCVE.org

Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

AnalysisAI

Cross-connection information disclosure in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote unauthenticated attackers to receive data belonging to other clients because the proxy improperly reuses upstream server sessions and tunnels. Because the scope changes across trust boundaries, one client can be served another client's response data, making this a confidentiality-critical issue in a shared caching/proxy tier. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; exploitation is timing/condition dependent (CVSS AC:H).

Technical ContextAI

Apache Traffic Server (ATS) is a high-performance forward and reverse HTTP caching proxy widely deployed as a CDN edge and internal caching layer. The flaw is rooted in ATS's connection-pooling logic: to improve performance ATS keeps and reuses persistent origin-server sessions and established tunnels across multiple downstream client connections. Under this vulnerability the reuse decision is made incorrectly, so a session/tunnel associated with one client connection can be handed to a different client, leaking response data across the boundary. This maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor); the CVSS Scope:Changed flag reflects that the impacted data belongs to a security authority (another client's connection) different from the vulnerable proxy component itself.

RemediationAI

Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 9.x line) or 10.1.4 (for the 10.x line) as published in the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. Deployments still on the 8.x branch have no fixed 8.x release listed and should migrate to a supported patched line. If immediate patching is not possible, reduce exposure by disabling or limiting origin server-session reuse and keep-alive session pooling (e.g., constrain proxy.config.http.server_session_sharing settings such as setting session sharing to 'none' or 'thread' and restricting match behavior) so sessions/tunnels are not shared across distinct client connections; the trade-off is reduced connection reuse and higher origin load/latency. As a further containment measure, terminate client TLS at ATS and segment untrusted clients from shared pools where feasible.