Apache Traffic Server CVE-2026-58180

Exploitation requires the target Apache Traffic Server to have the experimental txn_box plugin loaded and configured to process transactions - this is the concrete prerequisite, since the overflow lives in that plugin's handling of attacker-controlled request input and default ATS installations do not enable it. Once txn_box is active, no authentication or user interaction is needed (PR:N/UI:N) and the attack is delivered over the network (AV:N). The CVSS AT:P (attack requirement) flag signals that a specific condition beyond a plain request must hold - consistent with the input needing to reach and exceed the vulnerable buffer in the plugin's processing path. The chief limiting factor is therefore the non-default txn_box deployment; instances not running the plugin are not exposed.

The CVSS 4.0 base score of 8.2 (High) reflects AV:N (network), AC:L (low complexity), PR:N (no privileges) and UI:N (no user interaction), but crucially AT:P - a specific attack requirement must be met - and an impact set limited to VA:H with VC:N/VI:N (availability only, no data exposure or code integrity loss). This positions the vulnerability as a remotely triggerable denial-of-service rather than confirmed remote code execution, even though stack overflows can sometimes be escalated; neither the vendor advisory nor NVD claims code execution here. EPSS is not provided, the CVE is not in CISA KEV, and no POC is referenced, so real-world exploitation pressure is currently unproven. The decisive limiting factor is that the vulnerable txn_box plugin is experimental and not enabled in default ATS deployments, which sharply narrows the exposed population despite the network attack vector. Net assessment: patch promptly on any ATS instance running txn_box, but the practical risk to default installations is low because the code path is not loaded.

An attacker sends a crafted HTTP request whose fields exceed the size the txn_box plugin expects, overflowing a fixed-size stack buffer as the plugin processes the transaction. The corrupted stack causes the Traffic Server process to crash, dropping in-flight connections and denying service to legitimate users. No public exploit code is identified at time of analysis, and success depends on the target having the txn_box plugin loaded.