Which versions of Apache Traffic Server are affected by CVE-2026-58185?

Apache Traffic Server deployments (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) contain a use-after-free vulnerability in the intercept plugin that enables remote attackers to crash or…

How to fix or mitigate CVE-2026-58185?

Within 24 hours, conduct a complete inventory of all Apache Traffic Server deployments across your infrastructure and confirm which versions are running in each environment, prioritizing production systems running 8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3. Within 7 days, implement interim mitigations by restricting network access to intercept plugin configuration endpoints, disabling unused intercept plugins to reduce attack surface, and deploying enhanced monitoring for proxy crashes and abnormal behavior. Within 30 days, establish continuous monitoring of Apache Traffic Server vendor advisories for patch availability, prepare testing procedures and deployment processes for patched versions, and configure proxy failover or backup capacity to minimize availability impact if exploitation occurs.

Apache Traffic Server CVE-2026-58185

Q: What is the CVSS score of CVE-2026-58185?

CVE-2026-58185 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-50230 HIGH

Use After Free (CWE-416)

2026-07-29 apache

GHSA-qw2q-phpw-69hv

Apache Information Disclosure Use After Free Memory Corruption Apache Traffic Server Apache Software Foundation

8.2

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.2 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N), but the AT:P attack requirement maps to AC:H; impact is availability-only crash (A:H) with no confidentiality or integrity effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 10:32 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 10:22 vuln.today

cvss_changed

Severity Changed

Jul 29, 2026 - 10:22 NVD

MEDIUM HIGH

CVSS changed

Jul 29, 2026 - 10:22 NVD

5.9 (MEDIUM) 8.2 (HIGH)

Analysis Generated

Jul 29, 2026 - 09:54 vuln.today

CVE Published

Jul 29, 2026 - 08:57 cve.org

MEDIUM 5.9

DescriptionCVE.org

The Apache Traffic Server intercept plugin has a use-after-free.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

AnalysisAI

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a use-after-free (CWE-416) in the intercept plugin, allowing a remote attacker to crash or destabilize the proxy server. The flaw carries a CVSS 4.0 base score of 8.2, driven entirely by high availability impact with no confidentiality or integrity effect, and exploitation depends on a specific attack condition (AT:P) rather than being trivially reproducible. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Apache Traffic Server is a high-performance, open-source caching HTTP proxy and reverse proxy used in CDN and edge-serving deployments. The vulnerability resides in its intercept plugin, part of ATS's pluggable request-handling pipeline that lets plugins intercept and generate responses for connections. A use-after-free (CWE-416) occurs when the plugin references memory (a transaction, continuation, or buffer object) after it has already been freed, typically due to mismatched object lifecycle/reference-count handling during connection teardown or asynchronous event processing. Dereferencing freed memory in this context leads to memory corruption that manifests as a process crash, consistent with the availability-only impact profile in the CVSS vector. The single wildcard CPE (cpe:2.3:a:apache_software_foundation:apache_traffic_server) confirms the affected component is the core ATS product across the listed version ranges.

RemediationAI

Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 9.x line) or 10.1.4 (for the 10.x line), as directed in the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. Users on the 8.x line (8.0.0-8.1.9) have no dedicated patched 8.x release identified and should migrate to a fixed 9.2.15 or 10.1.4 build. As a compensating control where immediate patching is not possible, disable or unload the intercept plugin in remap/plugin configuration if your deployment does not depend on it, which removes the vulnerable code path at the cost of losing any interception functionality that plugin provides; alternatively, restrict network exposure of the ATS instance behind an upstream filtering layer or WAF to reduce the population of untrusted clients able to reach the affected code, accepting that this only narrows rather than eliminates the attack surface.