Which versions of Apache Traffic Server are affected by CVE-2026-58181?

Apache Traffic Server versions 8.0 through 10.1 with URL-signing plugins contain an unauthenticated denial-of-service vulnerability allowing remote attackers to crash proxy instances.

How to fix or mitigate CVE-2026-58181?

Within 24 hours, determine if uri_signing or url_sig plugins are loaded and enabled in your Apache Traffic Server deployment; installations without these plugins are not affected. Within 7 days, implement interim protections including upstream request filtering to block oversized URLs, strict connection timeouts on Traffic Server instances, and consideration of temporarily disabling URL-signing functionality if alternative mechanisms exist. Within 30 days, monitor Apache vendor advisories for patch availability and establish a deployment plan to upgrade affected Traffic Server instances when fixes are released.

Apache Traffic Server CVE-2026-58181

Q: What is the CVSS score of CVE-2026-58181?

CVE-2026-58181 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-50226 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-29 apache

GHSA-2vfg-xrq7-ffvf

Buffer Overflow Apache Stack Overflow Apache Traffic Server Apache Software Foundation

8.2

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.2 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote unauthenticated request crashes the proxy with no user interaction; impact is availability-only, so C:N/I:N/A:H, while the plugin-enabled precondition is a config dependency, not per-attack complexity, keeping AC:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 10:38 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 10:22 vuln.today

cvss_changed

Severity Changed

Jul 29, 2026 - 10:22 NVD

MEDIUM HIGH

CVSS changed

Jul 29, 2026 - 10:22 NVD

7.5 (MEDIUM) 8.2 (HIGH)

Analysis Generated

Jul 29, 2026 - 09:56 vuln.today

CVE Published

Jul 29, 2026 - 08:46 cve.org

MEDIUM 7.5

DescriptionCVE.org

The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

AnalysisAI

Denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) lets remote attackers crash the proxy by sending crafted input to the uri_signing or url_sig plugins, which recurse or copy unbounded data onto the stack until it is exhausted (CWE-121 stack-based buffer overflow). Only deployments that have loaded and enabled one of these URL-signing plugins are exposed; the impact is availability-only, with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the vendor CVSS 4.0 score of 8.2 reflects easy unauthenticated network reach against affected edge nodes.

Technical ContextAI

Apache Traffic Server is a high-performance caching HTTP proxy/CDN edge server whose functionality is extended through pluggable modules. Two of these, uri_signing and url_sig, validate signed/tokenized URLs so that only authorized clients can fetch protected origin content - uri_signing implements JWT/URI-based signing while url_sig checks HMAC query-string signatures. The vulnerability is classified CWE-121 (stack-based buffer overflow); the plugins can be driven to exhaust the process stack or otherwise crash when parsing attacker-controlled request data, consistent with unbounded recursion or an oversized on-stack copy during signature/URI parsing. The affected component is confirmed by CPE cpe:2.3:a:apache_software_foundation:apache_traffic_server and tags 'Buffer Overflow', 'Stack Overflow'. Because the parsing happens inline in the request path of these plugins, a single malformed request reaching a signing-enabled route is sufficient to fault the worker/process.

RemediationAI

Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 9.x line) or 10.1.4 (for the 10.x line), per the advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d; users on the 8.0.0-8.1.9 branch, for which no fixed 8.x release is listed, should upgrade to 9.2.15 or 10.1.4. If patching cannot be done immediately, the most effective compensating control is to unload or disable the uri_signing and url_sig plugins in remap.config/plugin.config where URL signing is not required, which fully removes the attack surface at the cost of losing signed-URL access control. Where the plugins must remain enabled, restrict which routes invoke them and place a rate-limiting or request-validating reverse proxy/WAF in front of signing-enabled endpoints to blunt crash attempts, accepting that this only reduces rather than eliminates the risk and adds latency. Ensure process supervision (systemd/traffic_manager auto-restart) is configured so a crashed server is respawned, treating this purely as a stopgap.