CVE-2026-58163: Apache Traffic Server DoS Vulnerability

CVE-2026-58163 Overview

CVE-2026-58163 is a high-severity vulnerability in Apache Traffic Server (ATS), an open-source HTTP forward and reverse proxy cache. The flaw stems from improper handling of on-disk cache fields and object lifetimes. An attacker can trigger state corruption or process crashes across affected releases.

The issue is categorized as [CWE-502] Deserialization of Untrusted Data. It affects Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. The Apache Traffic Server project has released fixed versions 9.2.15 and 10.1.4.

Critical Impact
Remote, unauthenticated attackers can corrupt cache state or crash Apache Traffic Server, degrading availability of proxied services.

Affected Products

Apache Traffic Server 8.0.0 through 8.1.9
Apache Traffic Server 9.0.0 through 9.2.14
Apache Traffic Server 10.0.0 through 10.1.3

Discovery Timeline

2026-07-29 - CVE-2026-58163 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-58163

Vulnerability Analysis

Apache Traffic Server maintains an on-disk object cache that stores serialized metadata about cached HTTP objects. CVE-2026-58163 arises when the proxy mishandles these on-disk cache fields and the lifetimes of the associated in-memory objects. When ATS reads or reconstructs cache entries, inconsistent field handling can leave objects in an invalid state or referenced beyond their valid lifetime.

The vulnerability maps to [CWE-502], indicating unsafe processing of serialized data structures. Corrupted state can propagate into request handling, producing incorrect cache responses or triggering a process crash. Because Apache Traffic Server sits inline in HTTP delivery paths, disruption directly affects downstream availability.

Root Cause

The root cause is improper validation and lifetime management of on-disk cache fields during deserialization. Fields loaded from persistent cache storage are not consistently reconciled with in-memory object lifetimes, allowing state corruption or dangling references to persist through subsequent request processing.

Attack Vector

The vulnerability is exploitable over the network with low attack complexity and no authentication or user interaction, though successful exploitation depends on specific cache conditions. An attacker sends crafted HTTP traffic that shapes cache contents. When the proxy later reads the corresponding on-disk cache fields, it processes them with incorrect object lifetimes, corrupting internal state or crashing the process.

For technical discussion and patch context, see the Apache Mailing List Thread.

Detection Methods for CVE-2026-58163

Indicators of Compromise

Unexpected traffic_server process crashes, restarts, or core dumps on ATS hosts.
Sudden increase in HTTP 5xx responses or cache-miss anomalies from Apache Traffic Server front ends.
Cache integrity warnings or deserialization errors in diags.log and traffic.out.

Detection Strategies

Inventory all Apache Traffic Server deployments and compare running versions against fixed releases 9.2.15 and 10.1.4.
Monitor ATS process supervision events for repeated exits or watchdog-triggered restarts.
Correlate proxy error rates with upstream origin health to distinguish ATS-side failures from backend issues.

Monitoring Recommendations

Ship diags.log, traffic.out, and system journal entries for ATS hosts into a centralized log platform for review.
Alert on abnormal cache eviction rates, on-disk cache reinitialization events, or repeated core file creation under the ATS runtime directory.
Track HTTP status distribution and latency baselines per ATS node to detect degradation patterns consistent with cache corruption.

How to Mitigate CVE-2026-58163

Immediate Actions Required

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4, which contain the fix.
Identify all ATS instances in production, staging, and disaster-recovery environments before scheduling upgrades.
Restrict inbound access to ATS management interfaces to trusted networks during the remediation window.

Patch Information

The Apache Traffic Server project has released fixed builds. Upgrade from any affected 8.x, 9.x, or 10.x release to 9.2.15 or 10.1.4. Note that no fixed release is listed for the 8.x branch; operators on 8.0.0 through 8.1.9 should migrate to a supported fixed branch. Release details are referenced in the Apache Mailing List Thread.

Workarounds

If patching cannot be completed immediately, clear the on-disk cache and reduce cache retention to limit exposure to corrupted entries.
Place a health-checked load balancer in front of ATS nodes to isolate crashing instances from production traffic.
Increase process supervision aggressiveness so crashed traffic_server processes restart promptly while remediation is in progress.

bash

# Verify installed Apache Traffic Server version
traffic_server -V

# After upgrade, confirm version is 9.2.15 or 10.1.4 or later
# Clear on-disk cache as a defensive step (stop service first)
sudo systemctl stop trafficserver
sudo traffic_server -Cclear
sudo systemctl start trafficserver