CVE-2026-58184CWE-787

CVE-2026-58184

High · published July 29, 2026

CVSS v3.1
8.2
EPSS
1%
Percentile
47.5
In the wild
Unconfirmed
What it is

The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00590 · 47.5th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2026-07-29T14:16Z
Affected products (3)
ProductVersionsFixed in
apache/traffic_server≥ 8.0.0, ≤ 8.1.9—
apache/traffic_server≥ 9.0.0, < 9.2.159.2.15
apache/traffic_server≥ 10.0.0, < 10.1.410.1.4
References (1)
https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d · [email protected]
EPSS history
Timeline
  • 29 JUL 08:56Z
    Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory
    cvelistv5