Apache Traffic Server CVE-2026-58160

No authentication against ATS is required - CVSS PR:N/UI:N confirms this is a zero-interaction, unauthenticated attack path from the ATS process's perspective. The key limiting factor is network positioning: an attacker must be able to influence DNS responses received by the ATS instance, achieved via compromise of an upstream DNS resolver, on-path DNS spoofing or poisoning between ATS and its resolver, or operating a malicious authoritative DNS server for a domain that ATS resolves. Default ATS deployments that perform DNS resolution for proxied requests are affected with no special configuration required. Exploitation is constrained to adversaries with DNS response injection capability; direct TCP/HTTP attackers against the ATS listener port cannot trigger this code path. All versions in the 8.x, 9.x, and 10.x branches are affected regardless of ATS feature configuration.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L scores 6.5 (Medium). The network attack vector with no authentication or user interaction is significant: because ATS performs DNS lookups for every proxied connection, any attacker who can influence DNS responses - via resolver compromise, DNS poisoning, or operating a malicious authoritative server - is a plausible threat actor without requiring access to the ATS host itself. Confidentiality impact is rated Low (partial memory disclosure) and Availability impact is Low (potential crash), with no integrity impact. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. No CISA KEV listing and no POC are identified, indicating no confirmed active exploitation at scale. Real-world risk is moderate-to-meaningful for ATS operators: a crash in the DNS path interrupts request processing for all traffic through the instance, and memory disclosure in a proxy could expose sensitive header or session data. The broad version range affected (spanning eight-plus years of releases across three branches) suggests significant unpatched surface area in production deployments.

An attacker who has compromised an upstream DNS resolver, or who can perform DNS spoofing on the network segment between ATS and its resolver, returns a crafted DNS answer with oversized or malformed record data. ATS parses the response and reads beyond the allocated buffer boundary, either leaking heap contents (visible in error logs or crafted response data returned to a client) or crashing the ATS worker process. No public POC is known at time of analysis, but the attack requires no credentials against ATS itself and only moderate network positioning.