CVE-2026-58179: Apache Traffic Server: regex_remap plugin overflows the stack from attacker input
The Apache Traffic Server regexremap plugin overflows the stack and integers from substitution input.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.15 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58179?
CVE-2026-58179 has a severity rating of 9.2, indicating it is critical.
How do I fix CVE-2026-58179?
To fix CVE-2026-58179, upgrade Apache Traffic Server to version 9.2.15 or 10.1.4.
What systems are affected by CVE-2026-58179?
CVE-2026-58179 affects Apache Traffic Server versions from 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.
What does CVE-2026-58179 exploit?
CVE-2026-58179 exploits a stack overflow vulnerability in the regex_remap plugin of Apache Traffic Server.
What are the potential impacts of CVE-2026-58179?
CVE-2026-58179 can lead to system crashes and unauthorized access due to stack and integer overflows.