CVE-2026-58164: Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free
Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58164?
CVE-2026-58164 is rated with a high severity score of 8.3.
How do I fix CVE-2026-58164?
To fix CVE-2026-58164, upgrade Apache Traffic Server to version 9.2.15 or 10.1.4.
What are the potential impacts of CVE-2026-58164?
CVE-2026-58164 can lead to use-after-free vulnerabilities that may cause application crashes.
Which versions of Apache Traffic Server are affected by CVE-2026-58164?
CVE-2026-58164 affects Apache Traffic Server versions from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3.
Is remote exploitation possible with CVE-2026-58164?
Yes, CVE-2026-58164 can be exploited remotely due to its access vector being classified as AV:N.