CVE-2026-58154: Apache Traffic Server: Memory-safety errors in MIME and header parsing
Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58154?
The severity of CVE-2026-58154 is rated as high with a score of 8.9.
How do I fix CVE-2026-58154?
To fix CVE-2026-58154, users should upgrade to Apache Traffic Server version 9.2.15 or 10.1.4.
What types of errors are associated with CVE-2026-58154?
CVE-2026-58154 is associated with memory-safety errors in MIME and HTTP header parsing.
Which versions of Apache Traffic Server are affected by CVE-2026-58154?
CVE-2026-58154 affects Apache Traffic Server versions from 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.
What impact can CVE-2026-58154 have on my system?
CVE-2026-58154 can potentially lead to out-of-bounds writes or integer overflows, compromising the integrity and security of the system.