CVE-2026-58158: Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow
Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.15 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58158?
The severity of CVE-2026-58158 is classified as high with a score of 8.2.
What types of issues does CVE-2026-58158 introduce?
CVE-2026-58158 introduces port truncation and a stack overflow vulnerability in Apache Traffic Server.
How do I fix CVE-2026-58158?
To fix CVE-2026-58158, upgrade Apache Traffic Server to version 9.2.15 or 10.1.4.
Which versions of Apache Traffic Server are affected by CVE-2026-58158?
CVE-2026-58158 affects Apache Traffic Server versions from 8.0.0 to 8.1.9, 9.0.0 to 9.2.14, and 10.0.0 to 10.1.3.
What are the consequences of not addressing CVE-2026-58158?
Failing to address CVE-2026-58158 may lead to service disruption due to the stack overflow vulnerability.