CVE-2026-58155
Last modified
CVE-2026-58155 is a critical-severity vulnerability rated 9.3/10 on the CVSS scale. Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Traffic Server | >= 8.0.0, <= 8.1.9 |
| Apache | Traffic Server | >= 9.0.0, < 9.2.15 |
| Apache | Traffic Server | >= 10.0.0, < 10.1.4 |
References
- https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6dVendor Advisory, Mailing List
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-58155?
How severe is CVE-2026-58155?
How do I fix CVE-2026-58155?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-5815A vulnerability was detected in D-Link DIR-645 1.01/1.02/1.0…8.8
- CVE-2026-58150Apache Traffic Server does not reject Transfer-Encoding in H…10
- CVE-2026-58151Apache Traffic Server can be crashed or driven to resource e…8.7
- CVE-2026-58152Apache Traffic Server mishandles integers while decoding HPA…6.9
- CVE-2026-58153Apache Traffic Server forwards HTTP/2 origin trailers to HTT…8.3
- CVE-2026-58154Apache Traffic Server can write out of bounds or overflow in…9.2
- CVE-2026-58156Apache Traffic Server mis-parses ports in URLs and userinfo,…6.3
- CVE-2026-58157Apache Traffic Server can reuse server sessions and tunnels …8.7
- CVE-2026-58158Apache Traffic Server mishandles PROXY protocol input, trunc…8.2
- CVE-2026-58159Apache Traffic Server can bypass IP access controls on UDS l…8.2
- CVE-2026-5816GitLab has remediated an issue in GitLab CE/EE affecting all…8.1
- CVE-2026-58160Apache Traffic Server reads out of bounds while parsing DNS …6.5
Are you affected by CVE-2026-58155?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST