Which versions of Apache Traffic Server are affected by CVE-2026-58164?

Apache Traffic Server proxy deployments (versions 8 through 10.1.3) contain a memory corruption vulnerability that could cause service outages or expose sensitive data.

How to fix or mitigate CVE-2026-58164?

Within 24 hours, inventory all systems running Apache Traffic Server to identify deployments on affected versions (8.x, 9.x up to 9.2.14, and 10.x up to 10.1.3). Within 7 days, upgrade 9.x branch systems to version 9.2.15 and 10.x branch systems to version 10.1.4; for 8.x branch systems, plan migration to a supported patched version or implement network-level isolation as interim control. Within 30 days, complete patching across all production and non-production environments and validate service stability through load testing and monitoring.

Apache Traffic Server CVE-2026-58164

Q: What is the CVSS score of CVE-2026-58164?

CVE-2026-58164 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-50220 HIGH

Use After Free (CWE-416)

2026-07-29 apache

GHSA-wf7j-7jm8-xrmj

Apache Information Disclosure Use After Free Memory Corruption Apache Traffic Server Apache Software Foundation

8.3

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.0 HIGH

Network-reachable and unauthenticated (AV:N/PR:N/UI:N), but the TOCTOU race window makes exploitation high-complexity (AC:H); impact is availability-heavy with only low C/I from freed-memory access.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 10:46 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 29, 2026 - 10:45 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 10:22 vuln.today

cvss_changed

Severity Changed

Jul 29, 2026 - 10:22 NVD

MEDIUM HIGH

CVSS changed

Jul 29, 2026 - 10:22 NVD

7.5 (MEDIUM) 8.3 (HIGH)

Analysis Generated

Jul 29, 2026 - 09:58 vuln.today

CVE Published

Jul 29, 2026 - 08:37 cve.org

MEDIUM 7.5

DescriptionCVE.org

Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

AnalysisAI

Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free and time-of-check/time-of-use race, primarily crashing the proxy (high availability impact) with secondary low-level confidentiality and integrity exposure. It affects the 8.x, 9.x, and 10.x branches up to 8.1.9, 9.2.14, and 10.1.3, and is fixed in 9.2.15 and 10.1.4. Reported by Apache with a CVSS 4.0 score of 8.3; no public exploit identified at time of analysis and it is not on CISA KEV.

Technical ContextAI

Apache Traffic Server (ATS) is a high-performance caching HTTP reverse/forward proxy used as CDN and edge infrastructure. The flaw resides in its remap subsystem, which maps inbound request URLs to upstream origins via remap.config rules. The root cause is CWE-416 (Use After Free) compounded by a TOCTOU race: an object referenced during remap processing can be freed and its memory reused, while a separate check-then-use window allows state to change between validation and access. Because remap handling occurs on the request path and can overlap with configuration reload/reprocessing, concurrent access to freed or mutated structures produces undefined behavior, most reliably a worker crash.

RemediationAI

Vendor-released patch: upgrade to 9.2.15 (for the 8.x and 9.x lines) or 10.1.4 (for the 10.x line), as directed in the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. The 8.x branch has no dedicated fixed build in the advisory, so 8.x deployments must move to 9.2.15 or later, which may require validating remap and plugin compatibility across the major-version jump. No official workaround is published; as compensating controls, restrict who can trigger remap configuration reloads and minimize concurrent config churn, and place a hardened front-end proxy or WAF with rate limiting ahead of ATS to blunt attempts to force the race under load - with the trade-off that this does not eliminate the flaw and adds latency and operational complexity. Monitor traffic_server worker processes for crashes/restarts as a detection signal.