CVE-2026-58187
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A vulnerability in the Apache Traffic Server multiplexer plugin causes a chunk-decode buffer overrun on upstream input, enabling denial of service. Affects versions from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3; fixed in versions 9.2.15 and 10.1.4.
Risk Assessment
The organization risks DoS attacks on the proxy server, potentially leading to network service disruptions and availability loss.
Recommendation
Update Apache Traffic Server to version 9.2.15 or 10.1.4 to eliminate the denial of service vulnerability.
Original NVD description (English source)
The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.