CVE-2026-58154
Last modified
CVE-2026-58154 is a critical-severity vulnerability rated 9.2/10 on the CVSS scale. Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Traffic Server | >= 8.0.0, <= 8.1.9 |
| Apache | Traffic Server | >= 9.0.0, < 9.2.15 |
| Apache | Traffic Server | >= 10.0.0, < 10.1.4 |
References
- https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6dVendor Advisory, Mailing List
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-58154?
How severe is CVE-2026-58154?
How do I fix CVE-2026-58154?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-58149Joomla Extension - joomdonation.com - User enumeration in Ev…5.3
- CVE-2026-5815A vulnerability was detected in D-Link DIR-645 1.01/1.02/1.0…8.8
- CVE-2026-58150Apache Traffic Server does not reject Transfer-Encoding in H…10
- CVE-2026-58151Apache Traffic Server can be crashed or driven to resource e…8.7
- CVE-2026-58152Apache Traffic Server mishandles integers while decoding HPA…6.9
- CVE-2026-58153Apache Traffic Server forwards HTTP/2 origin trailers to HTT…8.3
- CVE-2026-58155Apache Traffic Server truncates over-long header names, allo…9.3
- CVE-2026-58156Apache Traffic Server mis-parses ports in URLs and userinfo,…6.3
- CVE-2026-58157Apache Traffic Server can reuse server sessions and tunnels …8.7
- CVE-2026-58158Apache Traffic Server mishandles PROXY protocol input, trunc…8.2
- CVE-2026-58159Apache Traffic Server can bypass IP access controls on UDS l…8.2
- CVE-2026-5816GitLab has remediated an issue in GitLab CE/EE affecting all…8.1
Are you affected by CVE-2026-58154?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST