Which versions of Apache Traffic Server are affected by EUVD-2026-50229?

Apache Traffic Server (versions 8.0-10.1) contains a critical unauthenticated remote denial-of-service vulnerability in the header_rewrite plugin that can crash proxy infrastructure and corrupt…

How to fix or mitigate EUVD-2026-50229?

Within 24 hours: Inventory all systems running Apache Traffic Server versions 8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3 with header_rewrite plugin enabled, document network-facing exposure, and alert incident response teams. Within 7 days: Implement rate limiting and request validation on all inbound traffic to affected ATS instances, segregate vulnerable proxies from critical customer-facing paths where possible, and deploy continuous monitoring for proxy crashes and memory errors. Within 30 days: Establish formal upgrade timeline with Apache project, conduct proof-of-concept testing of migration to patched ATS versions or alternative proxy solutions, and document any architectural changes required to eliminate header_rewrite dependency.

Apache Traffic Server EUVD-2026-50229

Q: What is the CVSS score of EUVD-2026-50229?

EUVD-2026-50229 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-58184 HIGH

Out-of-bounds Write (CWE-787)

2026-07-29 apache

GHSA-m68v-95hx-r5c3

Buffer Overflow Apache Memory Corruption Apache Traffic Server Apache Software Foundation

8.3

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N), but requires a specific header_rewrite cookie/CIDR configuration (AC:H); impact is mainly a crash (A:H) with limited memory exposure (C:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 10:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 10:22 vuln.today

cvss_changed

Severity Changed

Jul 29, 2026 - 10:22 NVD

MEDIUM HIGH

CVSS changed

Jul 29, 2026 - 10:22 NVD

8.2 (MEDIUM) 8.3 (HIGH)

Analysis Generated

Jul 29, 2026 - 09:55 vuln.today

CVE Published

Jul 29, 2026 - 08:56 cve.org

MEDIUM 8.2

DescriptionCVE.org

The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

AnalysisAI

Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy or corrupt memory by triggering the plugin's cookie-manipulation and CIDR condition-matching logic. The flaw affects ATS 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3, and is reachable over the network without authentication (PR:N) when a vulnerable header_rewrite ruleset is deployed. No public exploit identified at time of analysis; the primary consequence is denial of service (VA:H) with limited information exposure (VC:L).

Technical ContextAI

Apache Traffic Server is a high-performance HTTP caching proxy and reverse proxy widely used in CDN and edge-caching tiers. The bug lives in header_rewrite, a first-class plugin that lets operators rewrite request/response headers using declarative rulesets, including cookie operations and conditions that match client IPs against CIDR ranges. The root cause is CWE-787 (Out-of-bounds Write): during cookie parsing/rewriting and CIDR comparison the plugin writes outside allocated bounds, which the vendor characterizes as a crash or memory corruption. The tags (Buffer Overflow, Memory Corruption) and CWE-787 both point to unsafe length/bounds handling on attacker-influenced header and address data processed inside the plugin.

RemediationAI

Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for 8.x and 9.x lines) or 10.1.4 (for 10.x), which fix the issue per the Apache advisory (https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d). Note the 8.x line has no dedicated fixed 8.x release listed, so 8.0.0-8.1.9 users must move to 9.2.15 or later. If immediate patching is not possible, the most direct compensating control is to remove or disable the header_rewrite plugin, or strip the specific cookie-manipulation operators and CIDR conditions from remap/global rulesets - the trade-off is loss of any header-rewriting behavior those rules provide (cookie normalization, IP-range-based routing/ACLs), which may break dependent functionality. Where header_rewrite must stay, restrict which upstreams and clients can reach the affected rules and monitor for proxy crashes/restarts as a detection signal.