CVE-2026-58151: Apache Traffic Server DoS Vulnerability

CVE-2026-58151 Overview

CVE-2026-58151 affects Apache Traffic Server (ATS), a high-performance forward and reverse proxy widely deployed in content delivery networks. Remote attackers can crash the proxy or drive it to resource exhaustion by sending abusive HTTP/2 framing and flow-control sequences. The flaw is tracked under CWE-400: Uncontrolled Resource Consumption and requires no authentication or user interaction. Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are affected. The Apache Software Foundation released fixed versions 9.2.15 and 10.1.4.

Critical Impact
Unauthenticated remote attackers can crash Apache Traffic Server or exhaust host resources by abusing HTTP/2 framing and flow-control, disrupting availability of proxied services.

Affected Products

Apache Traffic Server 8.0.0 through 8.1.9
Apache Traffic Server 9.0.0 through 9.2.14
Apache Traffic Server 10.0.0 through 10.1.3

Discovery Timeline

2026-07-29 - CVE-2026-58151 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-58151

Vulnerability Analysis

CVE-2026-58151 is a denial-of-service condition in the HTTP/2 implementation of Apache Traffic Server. The proxy fails to bound work and memory driven by adversarial HTTP/2 framing patterns and flow-control state manipulation. An attacker with a single TCP connection can therefore consume disproportionate CPU, memory, or connection-tracking resources on the server. Sustained abuse crashes the traffic_server process or renders the proxy unable to service legitimate clients.

The vulnerability follows the pattern of prior HTTP/2 protocol abuse issues such as Rapid Reset, in which multiplexing primitives amplify attacker cost efficiency. Because Apache Traffic Server is commonly positioned at the network edge, an outage propagates to every origin behind it.

Root Cause

The root cause is insufficient enforcement of limits on HTTP/2 frame processing and flow-control window updates [CWE-400]. Attacker-controlled inputs, including frame cadence, stream state transitions, and WINDOW_UPDATE values, are processed without adequate accounting or rate-limiting. This allows an attacker to submit low-cost frames that force the server into expensive internal operations.

Attack Vector

Exploitation requires only network reachability to an HTTP/2 listener on the proxy. The attacker negotiates HTTP/2 and issues crafted sequences of HEADERS, RST_STREAM, PRIORITY, SETTINGS, or WINDOW_UPDATE frames designed to inflate server-side work. No credentials, no user interaction, and no prior configuration change are required. Refer to the Apache Mailing List Discussion for protocol-level details.

Detection Methods for CVE-2026-58151

Indicators of Compromise

Sudden spikes in HTTP/2 stream creation and reset rates from a small number of client IPs.
Elevated CPU and memory utilization on traffic_server processes without corresponding legitimate traffic growth.
Repeated traffic_server restarts or crash logs referencing HTTP/2 stream or flow-control handling.
Abnormally high ratios of RST_STREAM or WINDOW_UPDATE frames relative to completed requests.

Detection Strategies

Alert on HTTP/2 connections producing high stream-open-to-completed-request ratios sustained over short intervals.
Correlate proxy crash and restart events with upstream client IPs and TLS SNI values to identify abusive peers.
Baseline normal HTTP/2 frame-type distributions and flag deviations, particularly excessive RST_STREAM and PRIORITY frames.

Monitoring Recommendations

Ingest Apache Traffic Server access, error, and diagnostic logs into a centralized analytics platform for rate-based analysis.
Monitor proxy.process.http2.* metrics for anomalous stream counts, connection counts, and error frequencies.
Track process-level telemetry, including restart counts and RSS growth, on hosts running traffic_server.

How to Mitigate CVE-2026-58151

Immediate Actions Required

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 on all affected hosts.
Inventory edge and internal proxy fleets to identify installations still on 8.x, since that branch does not have a fix listed in the advisory.
Place rate-limiting or upstream WAF controls in front of exposed HTTP/2 listeners until patching completes.

Patch Information

The Apache Software Foundation fixed CVE-2026-58151 in Apache Traffic Server 9.2.15 and 10.1.4. Deployments on the 8.x branch should plan migration to a supported fixed release. Refer to the Apache Mailing List Discussion for the official announcement and version guidance.

Workarounds

Disable HTTP/2 on internet-facing listeners by removing http2 from the proxy.config.http.server_ports configuration where feasible.
Lower HTTP/2 concurrency limits, including proxy.config.http2.max_concurrent_streams_in and active stream and frame timeouts, to reduce amplification.
Enforce per-source connection and request rate limits at an upstream load balancer or WAF.

bash

# Configuration example: reduce HTTP/2 exposure in records.config
CONFIG proxy.config.http2.max_concurrent_streams_in INT 100
CONFIG proxy.config.http2.stream_error_rate_threshold FLOAT 0.1
CONFIG proxy.config.http2.active_timeout_in INT 60
CONFIG proxy.config.http2.no_activity_timeout_in INT 30