CVE-2026-58178: Apache Traffic Server ESI DOS Vulnerability

CVE-2026-58178 Overview

CVE-2026-58178 affects the Edge Side Includes (ESI) plugin in Apache Traffic Server. The plugin recurses without bound and fetches attacker-controlled URLs during ESI processing. A remote unauthenticated attacker can trigger unbounded recursion by supplying crafted content that the plugin evaluates. The condition maps to [CWE-674] Uncontrolled Recursion. Affected releases include Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. The Apache Software Foundation fixed the issue in versions 9.2.15 and 10.1.4.

Critical Impact
Remote attackers can exhaust server resources and cause denial of service by driving the ESI plugin into unbounded recursion and forcing the server to fetch attacker-controlled URLs.

Affected Products

Apache Traffic Server 8.0.0 through 8.1.9
Apache Traffic Server 9.0.0 through 9.2.14
Apache Traffic Server 10.0.0 through 10.1.3

Discovery Timeline

2026-07-29 - CVE CVE-2026-58178 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-58178

Vulnerability Analysis

Apache Traffic Server ships an optional ESI plugin that processes Edge Side Includes markup inside cached responses. The plugin fetches referenced fragments and inlines them into the served content. Under CVE-2026-58178, the plugin follows include directives without enforcing a recursion depth limit. Each fetched fragment can itself contain further ESI includes, and the plugin continues resolving them.

Because the plugin fetches attacker-controlled URLs, a remote attacker can point the recursion at endpoints they operate. This produces server-initiated request loops, exhausts worker threads and sockets, and degrades or halts availability for legitimate traffic.

Root Cause

The root cause is missing depth and cycle enforcement in the ESI include resolution logic, classified under [CWE-674] Uncontrolled Recursion. The plugin trusts the include chain and does not cap nested fragment retrieval or detect cyclic references.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker submits or causes the origin to serve a response containing crafted ESI directives. When Apache Traffic Server processes the response through the ESI plugin, the server issues recursive fetches against attacker-controlled URLs. The condition impacts availability of the Traffic Server proxy.

No verified public exploit code is available at time of writing. See the Apache Mailing List Discussion for maintainer discussion of the fix.

Detection Methods for CVE-2026-58178

Indicators of Compromise

Sustained spikes in outbound HTTP requests from Traffic Server processes to previously unseen or attacker-associated hosts.
Rapid growth of ESI plugin worker threads, socket handles, or memory relative to inbound request volume.
Repeated fetches of the same or looping fragment URLs within a short time window.
Traffic Server error logs referencing ESI include processing failures or timeouts under load.

Detection Strategies

Alert on Traffic Server outbound request rate exceeding a baseline multiplier for a single client-facing request.
Correlate origin fetch chains that exceed a configured include-depth threshold in access logs.
Monitor for DNS resolution of low-reputation domains initiated by the Traffic Server service account.

Monitoring Recommendations

Ingest Traffic Server access, error, and ESI plugin logs into a centralized analytics platform for behavioral baselining.
Track process-level CPU, socket, and file descriptor usage for traffic_server and page on sharp deviations.
Enable network egress logging on proxy nodes and review destinations reached by ESI include operations.

How to Mitigate CVE-2026-58178

Immediate Actions Required

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4, which contain the fix.
If upgrade is not immediately possible, disable the ESI plugin by removing it from plugin.config until patched.
Restrict origin servers permitted to return ESI-tagged content to trusted sources only.
Apply egress filtering on Traffic Server hosts to block fetches to arbitrary external destinations.

Patch Information

The Apache Software Foundation released fixed builds in Apache Traffic Server 9.2.15 and 10.1.4. Upgrade guidance and release notes are available through the Apache Mailing List Discussion.

Workarounds

Remove the ESI plugin entry from plugin.config and reload Traffic Server to disable ESI processing entirely.
Constrain the plugin to specific remap rules so ESI parsing only applies to traffic from vetted origins.
Deploy an upstream filter that strips <esi:include> directives from responses returned by untrusted origins.

bash

# Configuration example: disable the ESI plugin in plugin.config
# Comment out the esi.so line and reload Traffic Server
# esi.so
traffic_ctl config reload