Apache Traffic Server CVE-2026-58163

Exploitation requires that Apache Traffic Server's on-disk cache is in use (persistent disk caching is a standard ATS deployment mode) so that malformed cache fields and object metadata are serialized and later deserialized - this disk-cache path is the vulnerable surface. The CVSS 4.0 AT:P flag indicates a specific additional attack requirement/race condition around object lifetimes must be satisfied, so exploitation is not fully deterministic even though it is network-reachable (AV:N), unauthenticated (PR:N), low-complexity (AC:L), and needs no user interaction (UI:N). Limiting factors: the target must be running an affected version (8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3) with disk caching engaged, and the impact is confined to availability/state corruption (crash) with no path to data disclosure.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, VC:N/VI:L/VA:H) describes a network-reachable, unauthenticated, low-complexity issue whose primary impact is availability (VA:H, likely a crash/DoS) with only limited integrity impact (VI:L, cache-state corruption) and no confidentiality loss - consistent with the description of 'corrupting state or crashing.' The AT:P metric is the key limiting signal: exploitation carries an attack requirement (a specific condition or race around cache object lifetimes must be met), so reliable weaponization is not guaranteed despite the low complexity. No EPSS score, KEV entry, or POC was provided, so real-world exploitation pressure appears low-to-moderate today; the score of 8.3 reflects potential DoS severity rather than confirmed mass exploitation. Bottom line: patch on a normal-to-prompt cadence for internet-facing ATS instances given the network/unauthenticated reach, but this is not a confirmed actively-exploited emergency based on available data.

A remote, unauthenticated attacker sends requests that cause specially shaped objects and cache fields to be written to and later read from the on-disk cache, triggering the mishandled deserialization and object-lifetime logic. When the corrupted state is reloaded or referenced, the Traffic Server process crashes or enters an inconsistent state, causing a denial of service for all users behind the proxy. No public POC is currently identified, and the AT:P attack requirement means the triggering condition may need to be met before the crash occurs reliably.