CVE-2026-58175: Apache Traffic Server Memory Leak Flaw

CVE-2026-58175 Overview

CVE-2026-58175 is a memory leak vulnerability in Apache Traffic Server, an open-source HTTP proxy and caching server. The flaw resides in the HostDB component that processes DNS Service (SRV) records. Each processed SRV record fails to release allocated memory, causing gradual resource exhaustion. Remote attackers can trigger the condition over the network without authentication or user interaction. The issue is tracked under CWE-401: Missing Release of Memory after Effective Lifetime. Affected versions span three major release lines: 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. The Apache Software Foundation released fixed versions 9.2.15 and 10.1.4.

Critical Impact
Sustained exploitation exhausts server memory and causes denial of service against internet-facing proxy infrastructure processing SRV lookups.

Affected Products

Apache Traffic Server 8.0.0 through 8.1.9
Apache Traffic Server 9.0.0 through 9.2.14
Apache Traffic Server 10.0.0 through 10.1.3

Discovery Timeline

2026-07-29 - CVE-2026-58175 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-58175

Vulnerability Analysis

Apache Traffic Server maintains a HostDB subsystem that caches DNS resolution results, including SRV records used to locate services within a domain. SRV records return a set of target hostnames with priority, weight, and port metadata. The HostDB code path allocates memory to hold parsed SRV response data but omits the deallocation step once processing completes. Each SRV lookup therefore consumes additional heap memory that is never returned to the allocator.

Over time, this leak drives the traffic_server process toward memory exhaustion. Once the process runs out of usable heap, the operating system either kills it or the proxy becomes unresponsive to client requests. High-throughput deployments accelerate the effect because every SRV-based origin lookup contributes to the leak.

Root Cause

The defect is a classic missing-free condition tied specifically to the SRV branch of the HostDB record handler. Structures allocated during SRV parsing lack the corresponding cleanup path present in the A and AAAA record processing routines. The fix ships in 9.2.15 and 10.1.4 and reintroduces symmetric deallocation for SRV entries.

Attack Vector

An attacker who can influence which hostnames Traffic Server resolves through SRV lookups can amplify the leak. Configurations that use SRV-based origin discovery are the primary attack surface. Repeated requests routed to origins requiring SRV resolution incrementally consume memory until the proxy fails. The vulnerability requires no credentials and can be triggered remotely over the network.

No verified proof-of-concept code has been published. Refer to the Apache Mailing List Thread for the vendor advisory.

Detection Methods for CVE-2026-58175

Indicators of Compromise

Continuously growing resident set size (RSS) of the traffic_server process without corresponding traffic growth
Out-of-memory kills of traffic_server recorded in dmesg or systemd journal logs
HostDB metrics showing sustained SRV lookup activity paired with rising heap allocation counters

Detection Strategies

Compare running Apache Traffic Server version against fixed releases 9.2.15 and 10.1.4 using configuration management inventory
Enable Traffic Server internal statistics and alert on proxy.process.hostdb counters trending abnormally against baseline
Correlate DNS query logs with proxy memory metrics to identify hosts issuing repeated SRV lookups

Monitoring Recommendations

Track memory utilization of traffic_server at one-minute granularity and alert on monotonic growth over multi-hour windows
Ingest process metrics and DNS resolver telemetry into a centralized analytics platform for correlation
Monitor for unplanned process restarts and OOM events on proxy nodes

How to Mitigate CVE-2026-58175

Immediate Actions Required

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 on all affected nodes
Inventory all proxy instances running the 8.x, 9.x, or 10.x branches to confirm patch coverage
Restart traffic_server processes exhibiting elevated memory consumption to reclaim leaked memory as a temporary measure

Patch Information

The Apache Software Foundation released fixed versions 9.2.15 and 10.1.4. The 8.x branch is out of active support, so operators running 8.0.0 through 8.1.9 must migrate to a supported branch. See the Apache Mailing List Thread for the official announcement.

Workarounds

Disable SRV record use in HostDB where operational requirements permit, avoiding the vulnerable code path
Schedule periodic traffic_server restarts on affected hosts until patched builds are deployed
Place capacity limits and rate controls in front of DNS resolution to slow leak accumulation

bash

# Verify installed Apache Traffic Server version
traffic_server -V

# Example upgrade on Debian/Ubuntu after adding fixed package
sudo apt-get update && sudo apt-get install --only-upgrade trafficserver

# Restart service to apply the patched binary
sudo systemctl restart trafficserver