CVE-2026-58163: Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server
Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.15 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58163?
The severity of CVE-2026-58163 is rated as high with a score of 8.3.
How do I fix CVE-2026-58163?
To fix CVE-2026-58163, upgrade Apache Traffic Server to version 9.2.15 or 10.1.4.
What causes CVE-2026-58163?
CVE-2026-58163 is caused by Apache Traffic Server mishandling on-disk cache fields and object lifetimes, leading to corrupted state or server crashes.
Which versions of Apache Traffic Server are affected by CVE-2026-58163?
CVE-2026-58163 affects Apache Traffic Server versions from 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.
What are the potential consequences of CVE-2026-58163?
The potential consequences of CVE-2026-58163 include corrupted state and crashes of the Apache Traffic Server.