Which versions of Apache Traffic Server are affected by CVE-2026-58163?

Apache Traffic Server versions 8.0.0-10.1.3 contain a remote deserialization vulnerability enabling unauthenticated attackers to crash proxy servers and corrupt internal cache state, disrupting all…

How to fix or mitigate CVE-2026-58163?

Within 24 hours: Identify and document all Apache Traffic Server installations and affected versions (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3). Within 7 days: Implement network-level access controls restricting unauthenticated connections to Traffic Server instances; deploy comprehensive logging and alerting for cache corruption events and unexpected process terminations. Within 30 days: Establish ongoing monitoring of vendor security advisories for patch releases; if no patch is published within 30 days, develop a permanent mitigation strategy such as load-balanced Traffic Server deployments with health checks and failover, hardware segmentation, or migration to alternative proxy solutions.

Apache Traffic Server CVE-2026-58163

Q: What is the CVSS score of CVE-2026-58163?

CVE-2026-58163 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-50219 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-29 apache

GHSA-6mpw-4jp8-fpfw

Apache Deserialization Apache Traffic Server Apache Software Foundation

8.3

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N), but the object-lifetime/race attack requirement maps to AC:H; impact is mainly a crash (A:H) with minor cache-state corruption (I:L) and no confidentiality loss.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 10:48 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 29, 2026 - 10:47 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 10:22 vuln.today

cvss_changed

Severity Changed

Jul 29, 2026 - 10:22 NVD

MEDIUM HIGH

CVSS changed

Jul 29, 2026 - 10:22 NVD

7.5 (MEDIUM) 8.3 (HIGH)

Analysis Generated

Jul 29, 2026 - 09:58 vuln.today

CVE Published

Jul 29, 2026 - 08:36 cve.org

MEDIUM 7.5

DescriptionCVE.org

Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

AnalysisAI

Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows remote unauthenticated attackers to crash the proxy or corrupt its internal state by abusing how on-disk cache fields and object lifetimes are deserialized and managed. The flaw is a CWE-502 untrusted-deserialization class issue tied to the disk cache subsystem; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 4.0 score of 8.3 is driven by high availability impact and low integrity impact with no confidentiality exposure.

Technical ContextAI

Apache Traffic Server is a high-performance forward and reverse caching HTTP proxy widely used by CDNs and large web infrastructures to cache and serve content. This vulnerability lives in the on-disk cache layer, where cached objects and their metadata (cache 'fields') are serialized to disk and later read back; the affected code mishandles those fields and the lifetime of the associated objects. The CWE-502 classification (Deserialization of Untrusted Data) and the 'Deserialization' tag indicate the root cause is unsafe reconstruction of cache-object state from persisted data, which can produce dangling or inconsistent objects (use-after-free / lifetime-confusion behavior) leading to state corruption or a crash. The single CPE (cpe:2.3:a:apache_software_foundation:apache_traffic_server) confirms the product is the ATS daemon itself rather than a plugin or dependency.

RemediationAI

Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 9.x line) or 10.1.4 (for the 10.x line) as documented in the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. Users still on the 8.x line have no fixed 8.x release and should migrate to 9.2.15 or 10.1.4. If immediate patching is not possible, the practical compensating control is to disable or reduce reliance on the on-disk (persistent) cache - for example run with RAM-only caching or reduce cache storage exposure - which removes the vulnerable disk-serialization path at the cost of losing cache persistence across restarts and lower cache hit ratios; additionally restrict network exposure of the proxy to trusted clients and front it with rate limiting to reduce the ability to drive the crash condition. Verify any workaround against your ATS configuration before deploying, as availability of the cache directly affects performance.