CVE-2026-58186: Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses
The Apache Traffic Server webptransform plugin can decode unsafely and serve mislabeled, cacheable responses.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Traffic Server (webp_transform plugin)to a version that resolves this vulnerability.Fixed in 9.2.15 - Upgrade
Upgrade
Apache Traffic Server (webp_transform plugin)to a version that resolves this vulnerability.Fixed in 10.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58186?
CVE-2026-58186 has a severity score of 7.5, which is considered high.
How do I fix CVE-2026-58186?
To fix CVE-2026-58186, upgrade to Apache Traffic Server version 9.2.15 or 10.1.4.
What versions of Apache Traffic Server are affected by CVE-2026-58186?
CVE-2026-58186 affects Apache Traffic Server versions from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3.
What is the impact of exploiting CVE-2026-58186?
Exploiting CVE-2026-58186 can lead to unsafe decoding and the serving of mislabeled, cacheable responses.
Is CVE-2026-58186 related to input validation issues?
Yes, CVE-2026-58186 is associated with input validation vulnerabilities in the webp_transform plugin.