SB20260824191 - Fedora 43 update for trafficserver
Published: August 24, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2026-58185)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute code using freed memory or cause a denial of service.
The vulnerability exists due to use-after-free in plugin: intercept when processing plugin operations. A remote attacker can trigger the use-after-free to execute code using freed memory or cause a denial of service.
2) Input validation error (CVE-ID: CVE-2026-58183)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input handling in plugin: prefetch when processing attacker-influenced input. A remote attacker can send crafted input to cause a denial of service.
3) Stack-based buffer overflow (CVE-ID: CVE-2026-58179)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service or execute arbitrary code.
The vulnerability exists due to stack-based buffer overflow in plugin: regex_remap when processing substitution input. A remote attacker can send crafted substitution input to cause a denial of service or execute arbitrary code.
The advisory also mentions integer overflow conditions.
4) Session Fixation (CVE-ID: CVE-2026-58157)
CWE-ID: CWE-384 - Session Fixation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper session management in HTTP state machine when reusing server sessions and tunnels across client connections. A remote attacker can trigger improper session reuse to disclose sensitive information.
5) Out-of-bounds read (CVE-ID: CVE-2026-58160)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.
The vulnerability exists due to out-of-bounds read in DNS when parsing DNS answers. A remote attacker can cause processing of crafted DNS responses to disclose sensitive information or cause a denial of service.
6) Improper Initialization (CVE-ID: CVE-2026-58182)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory or cause a denial of service.
The vulnerability exists due to improper initialization and resource handling in plugin: ts_lua when managing transform context and per-instance state. A remote attacker can trigger the flawed plugin behavior to corrupt memory or cause a denial of service.
7) NULL pointer dereference (CVE-ID: CVE-2026-58161)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to null pointer dereference and dangling reference in TLS/SNI when handling TLS and SNI processing. A remote attacker can send crafted input to cause a denial of service.
8) Stack-based buffer overflow (CVE-ID: CVE-2026-58158)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service or corrupt memory.
The vulnerability exists due to stack-based buffer overflow in PROXY protocol when parsing PROXY protocol input. A remote attacker can send crafted protocol input to cause a denial of service or corrupt memory.
The advisory also mentions port truncation in the same parser.
9) Use-after-free (CVE-ID: CVE-2026-58164)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute code using freed memory or cause a denial of service.
The vulnerability exists due to use-after-free in remap config when handling remap configuration lifetime and time-of-check/time-of-use conditions. A remote attacker can trigger remap configuration handling to execute code using freed memory or cause a denial of service.
10) Buffer overflow (CVE-ID: CVE-2026-58186)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory or poison cached responses.
The vulnerability exists due to unsafe decoding in plugin: webp_transform when decoding content for transformation. A remote attacker can supply crafted input to corrupt memory or poison cached responses.
The plugin can serve mislabeled, cacheable degraded responses.
11) Permissive Regular Expression (CVE-ID: CVE-2026-22068)
CWE-ID: CWE-625 - Permissive Regular Expression
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass access controls.
The vulnerability exists due to improper regular expression handling in remap, SNI, and plugins when performing selection with unanchored regular expressions. A remote attacker can supply values that match substrings or suffixes to bypass access controls.
The issue affects ACL, SNI, signature, and geo controls.
Remediation
Install update from vendor's website.