CVE-2026-58187: Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service
The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Traffic Server multiplexer plugin (chunk decoder)to a version that resolves this vulnerability.Fixed in 9.2.15 - Upgrade
Upgrade
Apache Traffic Server multiplexer plugin (chunk decoder)to a version that resolves this vulnerability.Fixed in 10.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58187?
The severity of CVE-2026-58187 is classified as low, with a score of 3.7.
How do I fix CVE-2026-58187?
To fix CVE-2026-58187, users should upgrade to Apache Traffic Server version 9.2.15 or later.
What is the risk associated with CVE-2026-58187?
CVE-2026-58187 poses a risk of denial of service due to a buffer overrun in the multiplexer plugin.
Which versions of Apache Traffic Server are affected by CVE-2026-58187?
CVE-2026-58187 affects Apache Traffic Server versions from 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.
What type of vulnerability is CVE-2026-58187?
CVE-2026-58187 is a denial of service vulnerability resulting from an overflow in the chunk-decoding buffer.