Which versions of Apache Traffic Server are affected by CVE-2026-58183?

Apache Traffic Server's prefetch plugin contains a high-severity denial of service vulnerability affecting caching proxy deployments in versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3.

How to fix or mitigate CVE-2026-58183?

Within 24 hours, identify all Apache Traffic Server instances and confirm affected versions (8.x through 10.1.3). Within 7 days, disable the prefetch plugin if operationally feasible and implement network-level input filtering to block malformed traffic directed at this component. Within 30 days, monitor vendor security advisories for patch availability and conduct pre-production testing of any released fixes before deployment.

Apache Traffic Server CVE-2026-58183

Q: What is the CVSS score of CVE-2026-58183?

CVE-2026-58183 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-50228 HIGH

Improper Input Validation (CWE-20)

2026-07-29 apache

GHSA-5gc7-q59c-j3fj

Denial Of Service Apache Apache Traffic Server Apache Software Foundation

8.2

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.2 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Remote unauthenticated DoS, but the optional prefetch plugin must be enabled to reach the code path (an attack requirement), so AC:H; availability-only impact gives A:H with C:N/I:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 10:35 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 10:22 vuln.today

cvss_changed

Severity Changed

Jul 29, 2026 - 10:22 NVD

MEDIUM HIGH

CVSS changed

Jul 29, 2026 - 10:22 NVD

5.9 (MEDIUM) 8.2 (HIGH)

Analysis Generated

Jul 29, 2026 - 09:55 vuln.today

CVE Published

Jul 29, 2026 - 08:55 cve.org

MEDIUM 5.9

DescriptionCVE.org

The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

AnalysisAI

Denial of service in Apache Traffic Server's prefetch plugin allows remote attackers to crash the caching proxy by supplying malicious input that the plugin fails to validate. Affected releases span the 8.x (8.0.0-8.1.9), 9.x (9.0.0-9.2.14), and 10.x (10.0.0-10.1.3) branches, and exploitation impacts only availability with no data exposure or code execution. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the vendor-assigned CVSS 4.0 base score is 8.2.

Technical ContextAI

Apache Traffic Server (ATS) is a high-performance HTTP caching proxy and reverse proxy used at CDN and edge scale. The vulnerability lives in the optional prefetch plugin, which speculatively fetches related objects to warm the cache. The root cause is classified as CWE-20 (Improper Input Validation): the plugin processes attacker-influenced input without adequately validating it, causing the ATS process to crash. Because the CPE only identifies the product generically (cpe:2.3:a:apache_software_foundation:apache_traffic_server:*), the version scoping must come from the advisory and EUVD version ranges rather than from the CPE string itself.

RemediationAI

Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 9.x branch) or 10.1.4 (for the 10.x branch), as directed in the Apache advisory (https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d); note the end-of-life 8.x branch has no fixed release listed, so 8.x users should migrate to a supported patched branch. If immediate patching is not possible, the most direct compensating control is to unload or disable the prefetch plugin in the remap/plugin configuration, which removes the vulnerable code path at the cost of losing prefetch cache-warming behavior. Alternatively, restrict which clients and upstreams can reach prefetch-enabled remap rules via network ACLs or a fronting WAF to limit exposure to attacker-influenced input, accepting that this narrows but does not fully eliminate reachability.