Buffer overflow in Apache Traffic Server - CVE-2026-58188
Published: August 24, 2026
Vulnerability identifier: #VU144776
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-58188
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to corrupt memory or bypass limits.
The vulnerability exists due to memory-safety errors in plugins (experimental) when processing plugin input. A remote attacker can trigger flawed plugin behavior to corrupt memory or bypass limits.
The issue affects several experimental plugins.
Affected software
Apache Traffic Server
Fedora
trafficserver
Fedora
trafficserver
How to mitigate CVE-2026-58188
Install security update from vendor's website.
Apache Traffic Server - addressed in versions 9.2.14, 10.1.3
trafficserver - addressed in versions 9.2.15-1.el8, 9.2.15-1.el9, 10.1.4-1.fc43, 10.1.4-1.fc44
trafficserver - addressed in versions 9.2.15-1.el8, 9.2.15-1.el9, 10.1.4-1.fc43, 10.1.4-1.fc44