CVE-2026-58187: 
Apache Traffic Server vulnerability analysis and mitigation

CVE-2026-58187 is a denial-of-service vulnerability in the Apache Traffic Server (ATS) multiplexer plugin caused by a buffer overrun in its chunk-decode buffer when processing upstream input. It affects Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. The vulnerability was published on July 29, 2026, with patches available in versions 9.2.15 and 10.1.4. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an out-of-bounds write (CWE-787) in the ATS multiplexer plugin's chunk-decode buffer, which can be overrun when processing malformed chunked transfer encoding data from upstream sources. An unauthenticated, network-adjacent attacker can send specially crafted HTTP requests with malformed chunked encoding to trigger the buffer overrun, crashing the Traffic Server process. No authentication or user interaction is required, though the CVSS v4.0 scoring notes that attack requirements (AT:P) are present, indicating some deployment-specific preconditions. No public proof-of-concept code has been identified (GitHub Advisory, Apache Mailing List).

Successful exploitation causes the Apache Traffic Server process to crash, resulting in a denial of service and service unavailability for all traffic routed through the affected ATS instance. There is no impact to confidentiality or integrity — the vulnerability is limited to availability. Organizations relying on ATS as a reverse proxy, CDN edge node, or caching layer could experience significant service disruption if exploited (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.29–0.45%, placing it in the lower-to-mid range for exploitation probability within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD's SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable (GitHub Advisory, Apache Mailing List).

Users should upgrade Apache Traffic Server to version 9.2.15 (for the 9.x branch) or 10.1.4 (for the 10.x branch) to remediate this vulnerability. The 8.x branch (8.0.0–8.1.9) does not have a patched release listed; users on this branch should migrate to a supported version. If immediate patching is not feasible, a recommended interim measure is to implement network-level filtering to restrict untrusted upstream traffic, or to place ATS behind a reverse proxy that validates and normalizes chunked transfer encoding before it reaches ATS (GitHub Advisory, Apache Mailing List).

Red Hat tracked the vulnerability via its Bugzilla system and assigned it medium priority and severity, indicating it is being monitored for impact on Red Hat products. The Apache Software Foundation disclosed the issue via its security mailing list. No notable independent researcher commentary or significant social media discussion has been identified beyond standard CVE aggregator coverage (Red Hat Bugzilla, Apache Mailing List).