CVE-2025-58136CWE-670

Apache Traffic Server: A simple legitimate POST request causes a crash

High · published April 2, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
51.5
In the wild
Unconfirmed
What it is

A bug in POST request handling causes a crash under a certain condition.

This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12.

Users are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue.

A workaround for older versions is to set proxy.config.http.request_buffer_enabled to 0 (the default value is 0).

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00673 · 51.5th percentile
Weakness
CWE-670 · Always-Incorrect Control Flow Implementation
Published
2026-04-02T15:54Z
EPSS history
Timeline
  • 02 APR 15:54Z
    Apache Traffic Server: A simple legitimate POST request causes a crash
    cvelistv5