Which versions of Apache Traffic Server are affected by CVE-2026-58177?

Apache Traffic Server versions 10.0.0 through 10.1.3 contain a memory corruption vulnerability (CVE-2026-58177) that allows remote, unauthenticated attackers to disrupt service availability and…

How to fix or mitigate CVE-2026-58177?

Within 24 hours: identify all Apache Traffic Server deployments running versions 10.0.0-10.1.3 and determine which use Cripts scripting-prioritize these for immediate remediation. Within 7 days: for affected systems, implement network segmentation to restrict untrusted traffic to Traffic Server, and deploy WAF or application-layer filtering to limit access to Cripts handlers; disable Cripts if not operationally required. Within 30 days: monitor Apache Foundation advisories for patch release announcements, prepare upgrade plan for patched Traffic Server versions when available, validate compensating controls under production load, and document remediation completion.

Apache Traffic Server CVE-2026-58177

Q: What is the CVSS score of CVE-2026-58177?

CVE-2026-58177 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-50222 HIGH

Out-of-bounds Write (CWE-787)

2026-07-29 apache

GHSA-xm2f-jc7r-hmhj

Buffer Overflow Apache Path Traversal Memory Corruption Apache Traffic Server Apache Software Foundation

8.3

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network, unauthenticated, no UI, but success needs Cripts in use so AC:H; impact is mainly availability (crash) with low integrity and no confidentiality, matching the memory-corruption/DoS profile.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:L/SI:L/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 10:43 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 29, 2026 - 10:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 10:22 vuln.today

cvss_changed

CVSS changed

Jul 29, 2026 - 10:22 NVD

8.1 (HIGH) 8.3 (HIGH)

Analysis Generated

Jul 29, 2026 - 09:52 vuln.today

CVE Published

Jul 29, 2026 - 08:42 cve.org

HIGH 8.1

DescriptionCVE.org

The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors.

This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 10.1.4, which fix the issue.

AnalysisAI

Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows remote attackers to trigger out-of-bounds writes, use-after-free conditions, and path traversal, primarily resulting in denial of service and partial integrity impact against the caching proxy. The CVSS 4.0 score of 8.3 (High) reflects a network-reachable, no-privilege attack whose success depends on a specific attack requirement (AT:P), such as a Cripts-based configuration being in use. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

Apache Traffic Server (ATS) is a high-performance HTTP caching proxy and reverse proxy used at CDN and edge scale. Cripts is ATS's modern C++ header-only scripting/plugin framework that lets operators write request/response processing logic that runs in-process within the traffic server. The reported defects - out-of-bounds writes (the root cause class captured by CWE-787), use-after-free, and path traversal - indicate unsafe memory handling and insufficient path/input sanitization within Cripts' request-handling code paths. Because Cripts logic executes inside the ATS worker process handling live client traffic, memory-safety errors there directly corrupt or crash the proxy process, and path traversal can allow access outside intended file boundaries. The CPE identifies the affected component as cpe:2.3:a:apache_software_foundation:apache_traffic_server, with the fault localized to the Cripts subsystem rather than core proxying.

RemediationAI

Vendor-released patch: upgrade Apache Traffic Server to version 10.1.4, which the Apache advisory states fixes the issue; this is the primary and recommended remediation. Consult the advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d for details. If immediate upgrade is not feasible, a targeted compensating control is to disable or remove Cripts-based scripts/plugins from the running configuration, since the flaw resides in the Cripts framework - the trade-off is loss of whatever custom request/response logic those Cripts implement. Additionally, restrict network exposure of the affected ATS instances (for example, front them with a hardened proxy or WAF and limit reachability to trusted clients) to reduce the unauthenticated network attack surface until 10.1.4 is deployed; the side effect is reduced accessibility for legitimate external clients.