Apache Traffic Server CVE-2026-58179

The regex_remap plugin must be explicitly loaded in ATS plugin.config and at least one remap rule using regex substitution must be active - this is a non-default configuration. The affected code path is reached only when an incoming HTTP request matches a configured regex_remap rule containing substitution groups (e.g., backreferences like \1 or $1). Exploitation is further constrained by AC:H in the CVSS vector, meaning the attacker must craft input that reliably triggers the overflow condition given the specific regex patterns deployed on the target, which requires knowledge of or guessing the active remap rules. What limits exploitation: the plugin must be enabled and configured with substitution-based remap rules; the attacker must be able to send HTTP requests that reach the ATS layer and match a configured pattern; high attack complexity reduces reliability of mass exploitation. What does NOT limit exploitation: no authentication is required (PR:N), and no user interaction is needed (UI:N).

CVSS 8.1 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H reflects high real-world impact tempered by elevated attack complexity. The AC:H designation is important: triggering the overflow reliably likely requires crafting specific substitution patterns that align with the regex_remap configuration deployed on the target, making mass exploitation harder than AC:L vulnerabilities. PR:N indicates no authentication is required from the CVSS perspective - the overflow is reachable via crafted HTTP requests processed by the plugin. The full C:H/I:H/A:H triad suggests the potential for memory corruption leading to arbitrary code execution or reliable crash. No EPSS data was provided in the intelligence, no CISA KEV listing is present, and no POC is publicly known, which moderates urgency relative to the raw score. The 8.x branch receives no named fix version, suggesting those users must migrate to 9.x or 10.x rather than applying a point patch - a meaningful operational consideration for teams still on 8.x.

An attacker targeting an ATS reverse proxy or CDN node that has regex_remap configured sends a specially crafted HTTP request whose URL or header fields match a configured regex pattern and contain a substitution payload designed to overflow the stack buffer. The integer overflow in substitution length calculation causes an undersized buffer to be allocated on the stack, and subsequent write operations corrupt adjacent stack frames, potentially redirecting control flow to attacker-controlled data. No POC has been publicly identified at time of analysis, but the vulnerability class (CWE-121 with network vector) is well-understood and historically exploitable.