Skip to main content

Apache Traffic Server CVE-2026-58180

| EUVDEUVD-2026-50225 HIGH
Stack-based Buffer Overflow (CWE-121)
2026-07-29 apache GHSA-jxxq-f4qq-497f
Buffer Overflow Apache Stack Overflow Apache Traffic Server
8.2
CVSS 4.0 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
8.2 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.9 MEDIUM

Network-reachable with no auth (AV:N/PR:N) but requires the non-default txn_box plugin and specific oversized input (AC:H); impact is availability-only DoS (A:H, C:N/I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

6
Analysis Updated
Jul 29, 2026 - 10:39 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 29, 2026 - 10:22 vuln.today
cvss_changed
Severity Changed
Jul 29, 2026 - 10:22 NVD
MEDIUM HIGH
CVSS changed
Jul 29, 2026 - 10:22 NVD
7.5 (MEDIUM) 8.2 (HIGH)
Analysis Generated
Jul 29, 2026 - 09:56 vuln.today
CVE Published
Jul 29, 2026 - 08:45 cve.org
MEDIUM 7.5

DescriptionCVE.org

The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

AnalysisAI

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-based buffer overflow in the txn_box plugin, which copies attacker-controlled input onto the stack without adequate bounds checking. Remote attackers reaching an ATS instance that loads the txn_box transaction-manipulation plugin can crash the server process; the CVSS 4.0 vector (8.2) scores the impact as availability-only (VA:H) with no confidentiality or integrity loss. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach ATS instance running txn_box
Delivery
Send oversized crafted HTTP request
Exploit
Overflow fixed-size stack buffer
Execution
Corrupt stack / return address
Persist
Crash Traffic Server process
Impact
Denial of service to clients
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the target Apache Traffic Server to have the experimental txn_box plugin loaded and configured to process transactions - this is the concrete prerequisite, since the overflow lives in that plugin's handling of attacker-controlled request input and default ATS installations do not enable it. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 8.2 (High) reflects AV:N (network), AC:L (low complexity), PR:N (no privileges) and UI:N (no user interaction), but crucially AT:P - a specific attack requirement must be met - and an impact set limited to VA:H with VC:N/VI:N (availability only, no data exposure or code integrity loss). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker sends a crafted HTTP request whose fields exceed the size the txn_box plugin expects, overflowing a fixed-size stack buffer as the plugin processes the transaction. The corrupted stack causes the Traffic Server process to crash, dropping in-flight connections and denying service to legitimate users. …
Remediation Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 or 10.1.4, which fix the overflow; the 8.x line is affected through 8.1.9 with no fixed 8.x release named in the advisory, so 8.x operators should migrate to a patched 9.2.x or 10.1.x build. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit your Apache Traffic Server deployment to identify all instances running versions 8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3; cross-reference configuration files to determine which systems have the txn_box plugin loaded. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Apache Traffic Server

View all
CVE-2026-58161 CRITICAL
9.2 Jul 29

Remote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
CVE-2026-58154 CRITICAL
9.2 Jul 29

Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
CVE-2026-58155 CRITICAL
9.2 Jul 29

Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
CVE-2026-58151 HIGH
8.7 Jul 29

Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
CVE-2026-58188 HIGH
8.4 Jul 29

Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
CVE-2026-58162 HIGH
8.4 Jul 29

Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
CVE-2026-58164 HIGH
8.3 Jul 29

Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
CVE-2026-58163 HIGH
8.3 Jul 29

Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
CVE-2026-58184 HIGH
8.3 Jul 29

Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy
CVE-2026-58177 HIGH
8.3 Jul 29

Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows rem
CVE-2026-58178 HIGH
8.2 Jul 29

Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers t
CVE-2026-58175 HIGH
8.2 Jul 29

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a memory

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.0
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Share

CVE-2026-58180 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy