Which versions of Apache Traffic Server are affected by CVE-2026-58180?

Apache Traffic Server versions 8.0.0-10.1.3 contain a remotely exploitable denial-of-service vulnerability in the txn_box plugin that allows attackers to crash the server process without user…

How to fix or mitigate CVE-2026-58180?

Within 24 hours, audit your Apache Traffic Server deployment to identify all instances running versions 8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3; cross-reference configuration files to determine which systems have the txn_box plugin loaded. Within 7 days, implement interim mitigations: disable the txn_box plugin on affected systems if operationally feasible, restrict network access to ATS instances to trusted internal sources only, or deploy load-balancer failover to maintain service availability if a process crash occurs. Within 30 days, upgrade to Apache Traffic Server 11.0.0 or later (if available and patched) or coordinate with Apache Traffic Server vendor support to obtain a fixed build for your current version line; establish a firm deployment date to minimize the window of unpatched exposure.

Apache Traffic Server CVE-2026-58180

Q: What is the CVSS score of CVE-2026-58180?

CVE-2026-58180 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-50225 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-29 apache

GHSA-jxxq-f4qq-497f

Buffer Overflow Apache Stack Overflow Apache Traffic Server Apache Software Foundation

8.2

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.2 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Network-reachable with no auth (AV:N/PR:N) but requires the non-default txn_box plugin and specific oversized input (AC:H); impact is availability-only DoS (A:H, C:N/I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 10:39 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 10:22 vuln.today

cvss_changed

Severity Changed

Jul 29, 2026 - 10:22 NVD

MEDIUM HIGH

CVSS changed

Jul 29, 2026 - 10:22 NVD

7.5 (MEDIUM) 8.2 (HIGH)

Analysis Generated

Jul 29, 2026 - 09:56 vuln.today

CVE Published

Jul 29, 2026 - 08:45 cve.org

MEDIUM 7.5

DescriptionCVE.org

The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

AnalysisAI

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-based buffer overflow in the txn_box plugin, which copies attacker-controlled input onto the stack without adequate bounds checking. Remote attackers reaching an ATS instance that loads the txn_box transaction-manipulation plugin can crash the server process; the CVSS 4.0 vector (8.2) scores the impact as availability-only (VA:H) with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Apache Traffic Server is a high-performance caching HTTP forward/reverse proxy widely used at CDN and edge scale. The flaw resides in txn_box, an experimental ATS plugin that lets operators rewrite and manipulate transactions (headers, URLs, request/response fields) via a declarative configuration. The root cause is CWE-121 (stack-based buffer overflow): the plugin writes attacker-influenced data into a fixed-size stack buffer without validating its length, corrupting adjacent stack memory such as saved registers or the return address. Because txn_box processes live request data, hostile input arrives over the network path the proxy already serves. The CPE cpe:2.3:a:apache_software_foundation:apache_traffic_server:*:*:*:*:*:*:*:* identifies the ATS package itself; the vulnerable code path is only reachable when the txn_box plugin is deployed and configured.

RemediationAI

Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 or 10.1.4, which fix the overflow; the 8.x line is affected through 8.1.9 with no fixed 8.x release named in the advisory, so 8.x operators should migrate to a patched 9.2.x or 10.1.x build. If immediate upgrade is not possible, the most effective compensating control is to unload or disable the txn_box plugin in plugin.config/remap.config, since the vulnerable code path is only reachable when that experimental plugin is active - the trade-off is loss of any transaction-rewriting rules it provides. As a secondary measure, filter and constrain untrusted input reaching txn_box-processed transactions (for example via upstream WAF/reverse-proxy validation of request fields), accepting that this only reduces rather than removes exposure. Refer to the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d for authoritative guidance.