SB20260824185 - Fedora EPEL 9 update for trafficserver

Description

This security bulletin contains information about 38 vulnerabilities.

1) Input validation error (CVE-ID: CVE-2026-58183)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input handling in plugin: prefetch when processing attacker-influenced input. A remote attacker can send crafted input to cause a denial of service.

2) Authentication Bypass by Spoofing (CVE-ID: CVE-2026-58162)

CWE-ID: CWE-290 - Authentication Bypass by Spoofing

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to spoof trusted certificates.

The vulnerability exists due to improper validation of client-controlled input in plugin: certifier when generating certificates from client SNI. A remote attacker can provide a crafted SNI value to spoof trusted certificates.

3) Deserialization of Untrusted Data (CVE-ID: CVE-2026-58163)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt state or cause a denial of service.

The vulnerability exists due to improper deserialization and lifetime management in cache when handling on-disk cache fields and object lifetimes. A remote attacker can trigger cache processing to corrupt state or cause a denial of service.

4) Use-after-free (CVE-ID: CVE-2026-58164)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute code using freed memory or cause a denial of service.

The vulnerability exists due to use-after-free in remap config when handling remap configuration lifetime and time-of-check/time-of-use conditions. A remote attacker can trigger remap configuration handling to execute code using freed memory or cause a denial of service.

5) Memory leak (CVE-ID: CVE-2026-58175)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled memory consumption in HostDB when handling SRV records. A remote attacker can trigger repeated SRV record processing to cause a denial of service.

The issue is caused by a memory leak.

6) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-58178)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform server-side request forgery or cause a denial of service.

The vulnerability exists due to improper restriction of recursive processing and URL fetching in plugin: ESI when recursing and fetching attacker-controlled URLs. A remote attacker can supply crafted content to perform server-side request forgery or cause a denial of service.

The plugin can recurse without bound.

7) Stack-based buffer overflow (CVE-ID: CVE-2026-58179)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service or execute arbitrary code.

The vulnerability exists due to stack-based buffer overflow in plugin: regex_remap when processing substitution input. A remote attacker can send crafted substitution input to cause a denial of service or execute arbitrary code.

The advisory also mentions integer overflow conditions.

8) Stack-based buffer overflow (CVE-ID: CVE-2026-58180)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service or execute arbitrary code.

The vulnerability exists due to stack-based buffer overflow in plugin: txn_box when processing attacker-controlled input. A remote attacker can send crafted input to cause a denial of service or execute arbitrary code.

9) Resource exhaustion (CVE-ID: CVE-2026-58181)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in plugin: uri_signing / url_sig when processing attacker input. A remote attacker can send crafted input to cause a denial of service.

The plugins can exhaust the stack or crash.

10) Improper Initialization (CVE-ID: CVE-2026-58182)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory or cause a denial of service.

The vulnerability exists due to improper initialization and resource handling in plugin: ts_lua when managing transform context and per-instance state. A remote attacker can trigger the flawed plugin behavior to corrupt memory or cause a denial of service.

11) Out-of-bounds read (CVE-ID: CVE-2026-58160)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds read in DNS when parsing DNS answers. A remote attacker can cause processing of crafted DNS responses to disclose sensitive information or cause a denial of service.

12) Buffer overflow (CVE-ID: CVE-2026-58184)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory or cause a denial of service.

The vulnerability exists due to memory corruption in plugin: header_rewrite when performing cookie operations. A remote attacker can send crafted input that triggers cookie handling to corrupt memory or cause a denial of service.

13) Use-after-free (CVE-ID: CVE-2026-58185)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute code using freed memory or cause a denial of service.

The vulnerability exists due to use-after-free in plugin: intercept when processing plugin operations. A remote attacker can trigger the use-after-free to execute code using freed memory or cause a denial of service.

14) Buffer overflow (CVE-ID: CVE-2026-58186)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory or poison cached responses.

The vulnerability exists due to unsafe decoding in plugin: webp_transform when decoding content for transformation. A remote attacker can supply crafted input to corrupt memory or poison cached responses.

The plugin can serve mislabeled, cacheable degraded responses.

15) Out-of-bounds write (CVE-ID: CVE-2026-58187)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in plugin: multiplexer when decoding upstream chunked input. A remote attacker can send crafted upstream input to cause a denial of service.

16) Buffer overflow (CVE-ID: CVE-2026-58188)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory or bypass limits.

The vulnerability exists due to memory-safety errors in plugins (experimental) when processing plugin input. A remote attacker can trigger flawed plugin behavior to corrupt memory or bypass limits.

The issue affects several experimental plugins.

17) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-58189)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform server-side request forgery.

The vulnerability exists due to improper state management in HTTP state machine when plugins reset the retry counter during redirect handling. A remote attacker can trigger redirect-limit bypass to perform server-side request forgery.

The issue enables SSRF amplification.

18) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-65100)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt subsequent HTTP/2 header processing.

The vulnerability exists due to improper state management in the HTTP/2 HPACK encoder when handling a failed header encode. A remote attacker can trigger an encode failure to corrupt subsequent HTTP/2 header processing.

The issue leaves the encoder out of sync with the peer decoder on the connection.

19) Improper Certificate Validation (CVE-ID: CVE-2026-65325)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass certificate hostname validation.

The vulnerability exists due to improper certificate validation in HTTP/2 multiplexed origin session reuse when reusing origin connections for a new request hostname. A remote attacker can trigger reuse of an existing connection to bypass certificate hostname validation.

20) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-24033)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform request smuggling.

The vulnerability exists due to improper parsing in HTTP/1 when processing chunked-extension quoted-string values. A remote attacker can send a specially crafted request to perform request smuggling.

The issue occurs when Apache Traffic Server is used as a reverse proxy.

21) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-33267)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform request smuggling and inject metadata.

The vulnerability exists due to improper neutralization of hop-by-hop and internal headers in HTTP/1 when processing requests from untrusted peers before plugin hooks. A remote attacker can send a specially crafted request to perform request smuggling and inject metadata.

22) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-58150)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform request smuggling.

The vulnerability exists due to improper input validation in HTTP/2 when handling requests containing Transfer-Encoding. A remote attacker can send a specially crafted request to perform request smuggling.

23) Resource exhaustion (CVE-ID: CVE-2026-58151)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in HTTP/2 when handling abusive framing and flow-control behavior. A remote attacker can send a specially crafted request sequence to cause a denial of service.

The server can be crashed or driven to resource exhaustion.

24) Out-of-bounds write (CVE-ID: CVE-2026-58154)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory or execute arbitrary code.

The vulnerability exists due to out-of-bounds write in header parsing (MIME) when parsing MIME and HTTP headers. A remote attacker can send a specially crafted request to corrupt memory or execute arbitrary code.

The advisory also mentions integer overflow conditions in the same parsing logic.

25) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-58155)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform request smuggling and bypass policies.

The vulnerability exists due to improper input validation in header parsing when processing over-long header names. A remote attacker can send a specially crafted request to perform request smuggling and bypass policies.

The issue involves header aliasing caused by header-name length truncation.

26) Session Fixation (CVE-ID: CVE-2026-58157)

CWE-ID: CWE-384 - Session Fixation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper session management in HTTP state machine when reusing server sessions and tunnels across client connections. A remote attacker can trigger improper session reuse to disclose sensitive information.

27) NULL pointer dereference (CVE-ID: CVE-2026-58161)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to null pointer dereference and dangling reference in TLS/SNI when handling TLS and SNI processing. A remote attacker can send crafted input to cause a denial of service.

28) Out-of-bounds write (CVE-ID: CVE-2026-58177)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory, traverse directories, or execute code using freed memory.

The vulnerability exists due to out-of-bounds write in Cripts when processing crafted framework input. A remote attacker can send specially crafted input to corrupt memory, traverse directories, or execute code using freed memory.

The advisory also reports path traversal and use-after-free conditions in the same framework.

29) Resource exhaustion (CVE-ID: CVE-2026-65324)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in HTTP/2 and HTTP/3 response dechunking when dechunking responses for a slow client. A remote attacker can trigger unbounded buffering to cause a denial of service.

Only dechunked HTTP/2 or HTTP/3 responses are affected.

30) Permissive Regular Expression (CVE-ID: CVE-2026-22068)

CWE-ID: CWE-625 - Permissive Regular Expression

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass access controls.

The vulnerability exists due to improper regular expression handling in remap, SNI, and plugins when performing selection with unanchored regular expressions. A remote attacker can supply values that match substrings or suffixes to bypass access controls.

The issue affects ACL, SNI, signature, and geo controls.

31) Stack-based buffer overflow (CVE-ID: CVE-2026-33930)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to stack-based buffer overflow in redirect handling when copying a client Host header into a fixed-size stack buffer. A remote attacker can send an over-long Host header to cause a denial of service.

The issue is triggered when redirect following is enabled.

32) Incorrect Comparison (CVE-ID: CVE-2026-41920)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass host-SNI policy.

The vulnerability exists due to incorrect string comparison in TLS/SNI when comparing the TLS SNI against the Host header using a length taken from the Host alone. A remote attacker can send a specially crafted SNI value to bypass host-SNI policy.

Any SNI value that has the Host header as a prefix can trigger the issue.

33) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-57834)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform request smuggling.

The vulnerability exists due to improper input validation in HTTP/1 when parsing malformed chunked message bodies. A remote attacker can send a specially crafted request to perform request smuggling.

34) Integer overflow (CVE-ID: CVE-2026-58152)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory.

The vulnerability exists due to integer overflow in HPACK/XPACK when decoding headers. A remote attacker can send crafted header input to corrupt memory.

35) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-58153)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform request smuggling.

The vulnerability exists due to improper message conversion in HTTP/2 · HTTP/3 → HTTP/1 when converting higher-version HTTP streams to HTTP/1 responses. A remote attacker can send a specially crafted request to perform request smuggling.

The issue can lose per-stream framing and forward origin trailers to clients.

36) Input validation error (CVE-ID: CVE-2026-58156)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass access controls.

The vulnerability exists due to improper parsing in URL parsing when processing ports in URLs and userinfo. A remote attacker can send a specially crafted URL to bypass access controls.

The issue affects port-based access controls.

37) Stack-based buffer overflow (CVE-ID: CVE-2026-58158)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service or corrupt memory.

The vulnerability exists due to stack-based buffer overflow in PROXY protocol when parsing PROXY protocol input. A remote attacker can send crafted protocol input to cause a denial of service or corrupt memory.

The advisory also mentions port truncation in the same parser.

38) Improper access control (CVE-ID: CVE-2026-58159)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass access controls.

The vulnerability exists due to improper access control in remap/ACL when handling UDS listeners and ACL matching. A remote attacker can exploit ACL matching errors to bypass access controls.

The advisory specifically mentions bypass of IP access controls on UDS listeners.

Remediation

Install update from vendor's website.

References

• https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-943e511d48