Skip to main content

Apache Traffic Server EUVDEUVD-2026-50208

| CVE-2026-58154 CRITICAL
Out-of-bounds Write (CWE-787)
2026-07-29 apache GHSA-pfrm-2m3q-3pcv
Buffer Overflow Memory Corruption Apache Apache Traffic Server
9.2
CVSS 4.0 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
9.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.9 HIGH

Remote unauthenticated header parsing (AV:N/PR:N/UI:N), but crafted-input and memory conditions justify AC:H; proxy compromise reaches backends so S:C, with memory corruption yielding I:H/A:H and limited C:L.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Severity Changed
Jul 29, 2026 - 09:22 NVD
HIGH CRITICAL
CVSS changed
Jul 29, 2026 - 09:22 NVD
8.9 (HIGH) 9.2 (CRITICAL)
Analysis Generated
Jul 29, 2026 - 08:52 vuln.today
CVE Published
Jul 29, 2026 - 08:24 cve.org
HIGH 8.9

DescriptionCVE.org

Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Articles & Coverage 1

News Critical Memory Corruption RCE in Apache Traffic Server - CVE-2026-58154 Jul 30, 2026

AnalysisAI

Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers corrupt memory by sending crafted headers to the proxy. It affects the 8.x, 9.x (through 9.2.14) and 10.x (through 10.1.3) branches, carries a high CVSS of 8.9 with a scope-change flag, and can lead to high integrity and availability impact. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach ATS proxy over network
Delivery
Send crafted MIME/HTTP headers
Exploit
Trigger integer overflow in parser
Execution
Force out-of-bounds write
Persist
Corrupt memory or crash service
Impact
Degrade proxy integrity/availability
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires sending crafted MIME/HTTP headers to a reachable Apache Traffic Server instance running an affected version (8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3); no authentication or user interaction is needed (PR:N/UI:N), so any party able to route requests through the proxy - or an origin whose responses ATS parses - can reach the vulnerable header-parsing path. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H describes a network-reachable, unauthenticated bug (PR:N/UI:N) with high attack complexity (AC:H), consistent with needing precisely crafted headers and favorable heap/integer conditions to reliably trigger the overflow rather than a trivial one-shot. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A remote attacker sends a specially crafted HTTP request with malformed or boundary-value MIME/header fields to an ATS instance (or, in reverse-proxy mode, induces a crafted origin response through it), triggering the integer overflow and out-of-bounds write during header parsing. Given AC:H, the attacker likely iterates over header sizes and values to reliably corrupt memory, most plausibly crashing the proxy (denial of service) or corrupting request state. …
Remediation Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 9.x line) or 10.1.4 (for the 10.x line) as published in the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all Apache Traffic Server instances in production environments and document their version numbers against the affected ranges (8.x, 9.x through 9.2.14, 10.x through 10.1.3). …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Apache Traffic Server

View all
CVE-2026-58161 CRITICAL
9.2 Jul 29

Remote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
CVE-2026-58155 CRITICAL
9.2 Jul 29

Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
CVE-2026-58151 HIGH
8.7 Jul 29

Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
CVE-2026-58188 HIGH
8.4 Jul 29

Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
CVE-2026-58162 HIGH
8.4 Jul 29

Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
CVE-2026-58164 HIGH
8.3 Jul 29

Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
CVE-2026-58163 HIGH
8.3 Jul 29

Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
CVE-2026-58184 HIGH
8.3 Jul 29

Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy
CVE-2026-58177 HIGH
8.3 Jul 29

Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows rem
CVE-2026-58180 HIGH
8.2 Jul 29

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-b
CVE-2026-58178 HIGH
8.2 Jul 29

Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers t
CVE-2026-58175 HIGH
8.2 Jul 29

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a memory

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Share

EUVD-2026-50208 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy