CVE-2026-58160: Apache Traffic Server Buffer Overflow

CVE-2026-58160 Overview

CVE-2026-58160 is an out-of-bounds read vulnerability [CWE-125] in Apache Traffic Server. The flaw resides in the DNS answer parsing logic, where the proxy reads memory beyond the intended buffer boundary while processing crafted DNS responses. The issue affects Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. The Apache Software Foundation has released fixed versions 9.2.15 and 10.1.4 to remediate the flaw. The vulnerability carries a CVSS 4.0 score of 6.3, reflecting network reach and low attack complexity with limited confidentiality and availability impact.

Critical Impact
A remote attacker able to influence DNS responses reaching Traffic Server can trigger an out-of-bounds read, potentially leaking process memory or crashing the proxy.

Affected Products

Apache Traffic Server 8.0.0 through 8.1.9
Apache Traffic Server 9.0.0 through 9.2.14
Apache Traffic Server 10.0.0 through 10.1.3

Discovery Timeline

2026-07-29 - CVE-2026-58160 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-58160

Vulnerability Analysis

Apache Traffic Server acts as a forward and reverse HTTP proxy. It performs its own DNS resolution to reach origin servers, parsing raw DNS response records rather than delegating fully to the system resolver. The flaw sits in the code path that parses DNS answer sections returned to the proxy.

When parsing an answer record, the resolver code fails to fully validate the record length and pointer offsets against the actual size of the received datagram. A crafted response can cause the parser to dereference bytes beyond the end of the DNS message buffer. This is a classic out-of-bounds read [CWE-125].

The consequence is twofold. The proxy may return incorrect data derived from adjacent process memory, and the read can also touch unmapped pages, producing a segmentation fault that terminates the worker. Both outcomes are consistent with the CVSS 4.0 vector describing low confidentiality impact and low availability impact.

Root Cause

The root cause is missing bounds validation while walking variable-length DNS answer fields, including compressed name pointers and RDATA. The parser advances offsets based on values taken from the untrusted response without confirming those offsets remain within the received packet.

Attack Vector

Exploitation requires the attacker to deliver a malicious DNS answer to a vulnerable Traffic Server instance. This can occur through a compromised or attacker-controlled authoritative name server, an on-path attacker performing DNS response injection, or cache poisoning against the upstream resolver used by the proxy. No authentication or user interaction is required. Technical details are described in the Apache Mailing List Thread.

Detection Methods for CVE-2026-58160

Indicators of Compromise

Unexpected traffic_server process crashes or restarts recorded by the service manager.
Diagnostic log entries from the HostDB or resolver subsystem referencing malformed DNS responses or truncated answers.
Sudden spikes in origin resolution failures correlated with responses from a specific upstream resolver or authoritative server.

Detection Strategies

Inventory Traffic Server deployments and flag any instance running a version below 9.2.15 or 10.1.4 in the affected ranges.
Inspect DNS traffic to the proxy for malformed answer sections, oversized RDATA fields, or invalid name compression pointers.
Correlate proxy crash events with the timing of inbound DNS responses to identify probing attempts.

Monitoring Recommendations

Alert on repeated worker process restarts of traffic_server within a short time window.
Monitor upstream DNS resolvers for integrity and enable DNSSEC validation where the origin zones support it.
Ingest Traffic Server diagnostic logs into a centralized logging pipeline to surface resolver errors at scale.

How to Mitigate CVE-2026-58160

Immediate Actions Required

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4, which contain the fix.
Identify all proxy instances still on 8.x and plan migration, as the fix is delivered only in the 9.x and 10.x release lines.
Restrict which upstream DNS resolvers the proxy may query and place them on trusted network segments.

Patch Information

The Apache Software Foundation addressed CVE-2026-58160 in Apache Traffic Server 9.2.15 and 10.1.4. Users on any listed vulnerable version should upgrade directly to a fixed release. Refer to the Apache Mailing List Thread for the official announcement.

Workarounds

Point Traffic Server at a hardened, validating recursive resolver that discards malformed DNS responses before they reach the proxy.
Enforce network egress filtering so the proxy can only reach approved DNS servers over UDP/TCP port 53.
Increase the frequency of traffic_server process supervision to recover quickly from any crash-based denial-of-service attempts pending patch deployment.

bash

# Verify installed Apache Traffic Server version
traffic_server --version

# Example: pin trusted resolvers in records.config
# proxy.config.dns.resolv_conf STRING /etc/trafficserver/resolv.conf
# /etc/trafficserver/resolv.conf
# nameserver 10.0.0.53
# nameserver 10.0.0.54