CVE-2026-58185: Apache Traffic Server: Use-after-free in the intercept plugin
The Apache Traffic Server intercept plugin has a use-after-free.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58185?
The severity of CVE-2026-58185 is classified as medium with a score of 5.9.
What is CVE-2026-58185 about?
CVE-2026-58185 is a use-after-free vulnerability found in the Apache Traffic Server intercept plugin.
How do I fix CVE-2026-58185?
To fix CVE-2026-58185, users should upgrade to Apache Traffic Server version 9.2.15 or 10.1.4.
Which versions of Apache Traffic Server are affected by CVE-2026-58185?
CVE-2026-58185 affects Apache Traffic Server versions from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3.
What impact does CVE-2026-58185 have on Apache Traffic Server?
CVE-2026-58185 can lead to potential denial-of-service conditions due to the use-after-free issue.