CVE-2026-58158: Apache Traffic Server Buffer Overflow

CVE-2026-58158 Overview

CVE-2026-58158 is a stack-based buffer overflow [CWE-121] in Apache Traffic Server. The flaw arises from mishandled PROXY protocol input, which truncates ports and writes beyond the bounds of a stack buffer. Remote, unauthenticated attackers can reach the code path over the network without user interaction. Successful exploitation impacts availability of the reverse proxy and can destabilize downstream services.

Affected releases include Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. The Apache Software Foundation recommends upgrading to 9.2.15 or 10.1.4.

Critical Impact
Unauthenticated attackers can trigger a stack overflow through crafted PROXY protocol input, causing denial of service in front-line caching proxies.

Affected Products

Apache Traffic Server 8.0.0 through 8.1.9
Apache Traffic Server 9.0.0 through 9.2.14
Apache Traffic Server 10.0.0 through 10.1.3

Discovery Timeline

2026-07-29 - CVE-2026-58158 published to the National Vulnerability Database
2026-07-30 - Last updated in the NVD database

Technical Details for CVE-2026-58158

Vulnerability Analysis

Apache Traffic Server (ATS) parses the PROXY protocol header on incoming connections to preserve the original client address when traffic arrives from an upstream load balancer. The parser mishandles the port field during this operation. Numeric truncation combined with insufficient bounds checking allows attacker-controlled input to write past the end of a fixed-size stack buffer. The condition is classified as a stack-based buffer overflow under [CWE-121].

The primary observed impact is high availability loss. A crafted PROXY header can corrupt the stack frame of the connection handler and crash the ATS worker process. Because ATS terminates client connections at the edge, a repeated crash loop removes the proxy tier from service and cascades to backend origins.

Root Cause

The root cause is improper validation of port values supplied inside PROXY protocol v1 or v2 headers. ATS truncates the port during conversion and writes the resulting data into a stack buffer that is not sized to accommodate all reachable input states. The combined truncation and missing length check produce a classic stack overflow condition.

Attack Vector

Exploitation requires network access to a listener configured to accept PROXY protocol input. An attacker connects to that listener and sends a malformed PROXY header containing an oversized or malformed port field. No authentication or user interaction is required. The vulnerability manifests only on ports where PROXY protocol acceptance is enabled in records.config or the equivalent YAML configuration.

No public proof-of-concept code is available. See the Apache Mailing List Discussion for the vendor announcement and patch references.

Detection Methods for CVE-2026-58158

Indicators of Compromise

Unexpected traffic_server process crashes or core dumps on hosts running affected versions.
Repeated TCP resets or connection failures from a single source targeting PROXY-enabled listeners.
Malformed PROXY protocol v1 or v2 headers in packet captures, especially with oversized or non-numeric port fields.
Gaps in traffic.out or diags.log immediately following worker restarts.

Detection Strategies

Inspect edge traffic for PROXY protocol v1 lines where the source or destination port exceeds five digits or contains non-ASCII bytes.
Correlate ATS worker restart events with source IP addresses of the last accepted connection to identify probe sources.
Alert on abnormal ratios of connection resets to established sessions on listeners with proxy_protocol_allowlist configured.

Monitoring Recommendations

Ingest ATS diagnostic logs and system journal entries into a centralized log platform for cross-host correlation.
Monitor process supervision events for traffic_server and traffic_manager restarts across the proxy fleet.
Track version inventory of ATS deployments to identify unpatched hosts running 8.x, 9.x prior to 9.2.15, or 10.x prior to 10.1.4.

How to Mitigate CVE-2026-58158

Immediate Actions Required

Upgrade Apache Traffic Server to 9.2.15 or 10.1.4. Version 8.x receives no fix and must be migrated to a supported branch.
Audit all listener configurations and disable PROXY protocol acceptance on any port that does not require it.
Restrict PROXY protocol listeners to trusted upstream load balancer IP ranges using network access control lists.
Enable process supervision and automatic restart for traffic_server to reduce recovery time from crash conditions.

Patch Information

The Apache Software Foundation released fixed versions 9.2.15 and 10.1.4. Users on the 8.x branch must migrate to a supported release line because 8.x remains vulnerable. Details are published in the Apache Mailing List Discussion.

Workarounds

Terminate PROXY protocol at an upstream component such as HAProxy or a cloud load balancer and forward plain TCP or HTTP to ATS.
Constrain the proxy_protocol_allowlist in records.config to explicit IP addresses of trusted upstream proxies.
Deploy network filtering to drop inbound PROXY headers on interfaces exposed to untrusted networks.

bash

# Configuration example: restrict PROXY protocol to trusted upstream IPs
# in records.config (Apache Traffic Server)
CONFIG proxy.config.http.proxy_protocol_allowlist STRING 10.0.0.0/8 192.168.10.0/24
CONFIG proxy.config.http.proxy_protocol_out INT 0

# Verify running version
traffic_server -V