Which versions of Apache Traffic Server are affected by CVE-2026-58182?

Apache Traffic Server versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 with the ts_lua plugin enabled are vulnerable to remote denial-of-service attacks that crash or hang the proxy, directly…

How to fix or mitigate CVE-2026-58182?

Within 24 hours, identify all Apache Traffic Server instances running versions 8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3 and determine which have the ts_lua plugin enabled; disable the ts_lua module where operationally feasible to eliminate the attack surface. Within 7 days, evaluate and plan upgrades to Apache Traffic Server version 9.3.x or later, 10.2.x or later, or version 11.x, coordinating with operations teams on deployment timing and rollback procedures. Within 30 days, complete all upgrades to non-vulnerable versions, conduct full validation in production to confirm traffic processing functions correctly and no service degradation has occurred.

Apache Traffic Server CVE-2026-58182

Q: What is the CVSS score of CVE-2026-58182?

CVE-2026-58182 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-50227 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-29 apache

GHSA-x56q-2cqh-7326

Denial Of Service Apache Apache Traffic Server Apache Software Foundation

8.2

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.2 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Remote and unauthenticated (AV:N/PR:N) but the AT:P precondition and ts_lua-only exposure map to AC:H; impact is availability-only (A:H, C/I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 10:36 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 10:22 vuln.today

cvss_changed

Severity Changed

Jul 29, 2026 - 10:22 NVD

MEDIUM HIGH

CVSS changed

Jul 29, 2026 - 10:22 NVD

8.6 (MEDIUM) 8.2 (HIGH)

Analysis Generated

Jul 29, 2026 - 09:55 vuln.today

CVE Published

Jul 29, 2026 - 08:54 cve.org

MEDIUM 8.6

DescriptionCVE.org

The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

AnalysisAI

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from the ts_lua plugin mishandling initialization, transform context, and per-instance state, allowing remote unauthenticated attackers to exhaust or corrupt resource state and crash or hang the proxy (CVSS 4.0 base 8.2, availability-only impact). Exploitation carries an attack requirement (AT:P), meaning a specific condition beyond the attacker's control must hold, and only deployments that actually load the ts_lua scripting plugin are affected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; treat it as a serviceability/uptime risk to Lua-enabled ATS proxies.

Technical ContextAI

Apache Traffic Server is a high-performance, event-driven forward and reverse caching HTTP proxy widely used as a CDN edge and origin-shield layer. The ts_lua plugin embeds a LuaJIT/Lua scripting engine so operators can attach per-request hooks, response/request transforms, and per-instance configuration to the proxy pipeline. The flaw is rooted in CWE-400 (Uncontrolled Resource Consumption): the plugin mismanages its lifecycle state - specifically initialization sequencing, the transform context used for streaming body rewrites, and per-instance state isolation. When these states are mishandled, resources tied to Lua VM contexts or transform buffers are not correctly bounded or released, letting an attacker drive the process toward resource exhaustion or an inconsistent-state crash. The CPE covers cpe:2.3:a:apache_software_foundation:apache_traffic_server across all listed versions, but the defect lives in the optional ts_lua plugin rather than the core proxy.

RemediationAI

Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 9.x line) or 10.1.4 (for the 10.x line), per the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d; note that the 8.x line (8.0.0-8.1.9) is listed as affected but no fixed 8.x release is named, so 8.x operators should plan a migration to a patched 9.2.15+ or 10.1.4+ release. If patching cannot be done immediately, the most direct compensating control is to disable or unload the ts_lua plugin (remove its plugin.config / remap.config entries), which fully removes the exposure at the cost of losing any Lua-based request/response scripting your configuration relies on. Where ts_lua must stay enabled, restrict who can reach the affected proxy paths and put rate-limiting or an upstream WAF/load balancer in front of the ATS tier to blunt resource-exhaustion attempts, accepting that this mitigates rather than eliminates the DoS risk.