Apache Traffic Server CVE-2026-58185

Exploitation requires that the target Apache Traffic Server deployment loads and uses the intercept plugin - that is the exact feature that contains the vulnerable use-after-free code path; instances not using the intercept plugin are not exposed. The CVSS 4.0 vector specifies AV:N/PR:N/UI:N (network-reachable, no authentication, no user interaction), so a remote unauthenticated attacker can reach it, but the AT:P metric indicates a specific attack requirement must be met - likely a particular connection lifecycle, timing, or plugin state - which limits reliable exploitation. Affected versions are strictly 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3; instances already on 9.2.15/10.1.4 or not running the intercept plugin are not exploitable. Impact is limited to availability (service crash/DoS), not code execution or data theft.

Signals are moderate and internally consistent on impact but limited on exploitation likelihood. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) indicates a network-reachable, unauthenticated, low-complexity attack, but the AT:P (attack requirements present) metric signals that success depends on specific conditions such as timing or a particular plugin/connection state - this is what tempers the score to 8.2 and separates it from a trivially weaponizable bug. Impact is availability-only (VA:H, with VC:N/VI:N), so this is a denial-of-service class issue, not remote code execution or data disclosure, despite the 'Information Disclosure' tag in the source metadata - that tag conflicts with the vendor CVSS vector (VC:N) and should be treated with caution pending vendor clarification. No EPSS score, no KEV listing, and no POC were provided, so real-world exploitation probability cannot be quantified from the available data. Net: a credible DoS priority for internet-facing ATS deployments, but not an emergency on par with an exploited RCE. Note the discrepancy: the tag set implies information disclosure while the authoritative CVSS vector implies availability-only - verify with the Apache advisory before assuming confidentiality exposure.

An attacker who can reach an internet-facing Apache Traffic Server that loads the intercept plugin sends crafted requests or manipulates connection timing/teardown to trigger the use-after-free, causing the proxy process to dereference freed memory and crash. Because exploitation carries an attack requirement (AT:P), the attacker may need to hit a specific race or connection state, potentially repeating the attempt to reliably crash the service. No public exploit code is identified at time of analysis.