CVE-2026-58179 Overview
CVE-2026-58179 is a stack-based buffer overflow ([CWE-121]) in the regex_remap plugin of Apache Traffic Server. The plugin fails to safely handle substitution input, causing both a stack overflow and integer overflow during URL rewriting. Attackers can trigger the flaw remotely over the network without authentication or user interaction. The vulnerability affects Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. The Apache Software Foundation released fixed versions 9.2.15 and 10.1.4 to address the issue.
Critical Impact
Unauthenticated attackers can send crafted HTTP requests to a proxy configured with regex_remap to corrupt stack memory, potentially leading to arbitrary code execution or denial of service.
Affected Products
- Apache Traffic Server 8.0.0 through 8.1.9
- Apache Traffic Server 9.0.0 through 9.2.14
- Apache Traffic Server 10.0.0 through 10.1.3
Discovery Timeline
- 2026-07-29 - CVE-2026-58179 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-58179
Vulnerability Analysis
Apache Traffic Server is a widely deployed HTTP caching proxy and reverse proxy. The regex_remap plugin performs URL rewriting using regular expression pattern matching with substitution templates. During substitution processing, the plugin writes rewritten URL segments into a fixed-size stack buffer without validating that the substituted output fits within the allocated bounds.
Attacker-controlled input drives the substitution length, and the plugin performs arithmetic on this length using integer types that can wrap. The resulting integer overflow bypasses the intended size checks, allowing the plugin to write past the stack buffer boundary. This corrupts saved return addresses, frame pointers, and adjacent local variables.
Root Cause
The root cause is unsafe substitution handling in the regex_remap plugin. The plugin combines a fixed-capacity stack buffer with unchecked or wrap-prone length arithmetic ([CWE-121]). When substitution input exceeds the assumed capacity, the plugin writes attacker-controlled bytes into stack memory belonging to the calling function.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker sends a crafted HTTP request whose URL path or matched capture groups produce an oversized substitution when expanded by a configured regex_remap rule. The request reaches the plugin through normal proxy request handling. Because Apache Traffic Server frequently sits at the network edge, exposed instances handling attacker-controlled URLs are directly reachable from the internet.
No verified public exploit code is available. Refer to the Apache Mailing List Thread for the coordinated disclosure details.
Detection Methods for CVE-2026-58179
Indicators of Compromise
- Apache Traffic Server process crashes, segmentation faults, or restarts logged in traffic.out or diags.log correlated with inbound HTTP requests.
- Unusually long URLs or request paths in access logs that match regex_remap rule patterns.
- HTTP requests containing crafted path segments designed to expand substitution capture groups to large sizes.
Detection Strategies
- Inventory Apache Traffic Server deployments and identify hosts running vulnerable versions 8.0.0–8.1.9, 9.0.0–9.2.14, or 10.0.0–10.1.3 with the regex_remap plugin enabled.
- Inspect remap.config and plugin configuration files for regex_remap.so entries and enumerate the substitution patterns in use.
- Deploy web application firewall or IDS rules that flag oversized URL paths and repeated crash-inducing requests against proxy endpoints.
Monitoring Recommendations
- Alert on Apache Traffic Server worker crashes, core dumps, or unexpected restarts within your host telemetry pipeline.
- Monitor proxy access logs for statistical anomalies in URL length and request-per-source patterns targeting rewrite endpoints.
- Track outbound network connections initiated by the Apache Traffic Server process to detect post-exploitation activity.
How to Mitigate CVE-2026-58179
Immediate Actions Required
- Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4, which contain the official fix.
- Audit all remap.config entries and identify every rule referencing the regex_remap plugin.
- Restrict network exposure of proxy instances that cannot be immediately patched, placing them behind an authenticated boundary where feasible.
Patch Information
The Apache Software Foundation released Apache Traffic Server 9.2.15 and 10.1.4 to fix CVE-2026-58179. Users on the 8.x branch should migrate to a supported fixed version, as no patched 8.x release is listed in the advisory. See the Apache Mailing List Thread for the official announcement.
Workarounds
- Disable the regex_remap plugin by removing or commenting out its entries in remap.config until the upgrade is applied.
- Replace regex_remap rules with static remap entries where the substitution patterns are simple enough to translate.
- Enforce request-size and URL-length limits at an upstream load balancer or web application firewall to reduce the substitution input surface.
# Configuration example: disable regex_remap and reload configuration
# 1. Comment out regex_remap.so lines in remap.config
sed -i 's|^\(.*regex_remap\.so.*\)$|# \1|' /etc/trafficserver/remap.config
# 2. Verify configuration syntax
traffic_ctl config verify
# 3. Reload Apache Traffic Server to apply changes
traffic_ctl config reload
# 4. Confirm running version after upgrade
traffic_server --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
