Apache Traffic Server CVE-2026-58189

Exploitation requires an Apache Traffic Server deployment (8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3) that is configured to follow HTTP redirects AND is running a plugin that resets the retry/redirect counter during processing - this counter reset is the exact condition that defeats the redirect-limit safeguard (reflected as CVSS AT:P). The attack is network-reachable and unauthenticated (AV:N/PR:N/UI:N) with low complexity, so no credentials or user interaction are needed, but the plugin-dependent attack requirement is the primary limiting factor: default ATS installations without a counter-resetting plugin are not exploitable. Impact is limited to availability/amplification (VA:H, SA:L); there is no confirmed confidentiality or integrity impact.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L, score 8.2) indicates a network-reachable, unauthenticated, low-complexity issue whose impact is concentrated on availability (VA:H) with a limited subsequent-system availability effect (SA:L) and no confidentiality or integrity impact - consistent with an amplification/DoS-style SSRF rather than internal-data theft. The AT:P (attack requirement) flag is significant: exploitation is not universal but depends on ATS running a plugin that resets the retry counter, which meaningfully narrows the real-world exploitable population and should be weighed against the otherwise high score. No EPSS score, KEV listing, or POC was provided, so despite the High CVSS this is not a confirmed at-scale exploitation event; treat it as a prioritized patch for edge/proxy fleets running redirect-following plugins rather than an emergency drop-everything item. Note the classification tension worth verifying with the vendor: this is tagged SSRF (CWE-918), which typically implies confidentiality/integrity risk against internal endpoints, yet the CVSS models only availability impact - the practical risk here is amplification/resource exhaustion, not internal resource disclosure.

An attacker sends a crafted request through an ATS instance whose redirect-following passes through a plugin that resets the retry counter, causing ATS to follow a long redirect chain instead of stopping at the configured limit. By pointing the chain at attacker-chosen or internal targets, the single request is amplified into many proxy-originated outbound requests, exhausting resources or hammering a backend. No public exploit code was identified at time of analysis, and success depends on the presence of the counter-resetting plugin (CVSS AT:P).