CVE-2026-58178: Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery
The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58178?
The severity of CVE-2026-58178 is high with a CVSS score of 8.2.
How do I fix CVE-2026-58178?
To fix CVE-2026-58178, users should upgrade to Apache Traffic Server version 9.2.15 or 10.1.4.
What causes CVE-2026-58178?
CVE-2026-58178 is caused by the ESI plugin in Apache Traffic Server allowing uncontrolled recursion and server-side request forgery.
Which versions of Apache Traffic Server are affected by CVE-2026-58178?
Apache Traffic Server versions from 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are affected by CVE-2026-58178.
What is the risk associated with CVE-2026-58178?
CVE-2026-58178 poses a risk level of 43 due to its potential to facilitate exploitation through recursion and request forgery.