CVE-2026-58184: Apache Traffic Server DoS Vulnerability

CVE-2026-58184 Overview

CVE-2026-58184 is a memory corruption vulnerability in the header_rewrite plugin of Apache Traffic Server (ATS). The plugin can crash or corrupt memory during cookie operations and Classless Inter-Domain Routing (CIDR) condition matching. The flaw is classified under [CWE-787] (Out-of-Bounds Write) and is remotely exploitable over the network without authentication or user interaction. Affected releases include Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. The Apache Software Foundation has released fixes in versions 9.2.15 and 10.1.4.

Critical Impact
Remote attackers can trigger a denial of service or memory corruption in ATS proxy nodes by sending crafted requests that exercise the vulnerable header_rewrite cookie and CIDR logic.

Affected Products

Apache Traffic Server 8.0.0 through 8.1.9
Apache Traffic Server 9.0.0 through 9.2.14
Apache Traffic Server 10.0.0 through 10.1.3

Discovery Timeline

2026-07-29 - CVE-2026-58184 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-58184

Vulnerability Analysis

Apache Traffic Server ships with the header_rewrite plugin, which lets operators inspect and modify HTTP headers, cookies, and client attributes at proxy time. Two code paths in this plugin mishandle memory: cookie parsing and CIDR-based condition matching. When ATS processes a request that triggers these operations, the plugin can write outside allocated buffers or reference invalid memory. The result is an out-of-bounds write ([CWE-787]) that can crash the ATS worker process or corrupt adjacent heap structures.

Since ATS is deployed as a reverse proxy or forward proxy at network edges, a single crash affects every client routed through the node. Sustained exploitation degrades availability across all upstream services behind the proxy.

Root Cause

The root cause resides in the header_rewrite plugin's handling of cookie values and CIDR match expressions. The plugin does not correctly validate buffer boundaries when parsing cookie tokens or when evaluating CIDR conditions against client addresses. Under specific inputs, the plugin writes past the intended buffer or dereferences memory in an unsafe manner, producing the observable crash or corruption behavior. See the Apache Mailing List Discussion for maintainer-provided technical detail.

Attack Vector

An unauthenticated remote attacker sends HTTP requests to an ATS instance configured with the header_rewrite plugin. Requests that exercise cookie parsing or CIDR-based conditional logic can reach the vulnerable code paths. No user interaction is required. The primary impact is on availability, with potential secondary confidentiality risk if adjacent memory contents leak into responses.

Refer to the Apache Mailing List Discussion for exploitation prerequisites and configuration context.

Detection Methods for CVE-2026-58184

Indicators of Compromise

Unexpected crashes or SIGSEGV entries for the traffic_server process in system logs or core dump directories.
Sudden restarts of ATS worker processes correlated with bursts of client requests containing unusual cookie headers.
Elevated 5xx error rates from ATS nodes without corresponding origin server faults.

Detection Strategies

Inventory ATS deployments and confirm the loaded plugin list. Flag any node running header_rewrite.so on versions 8.0.0–8.1.9, 9.0.0–9.2.14, or 10.0.0–10.1.3.
Alert on repeated ATS process restarts or crash-loop patterns in process supervisors such as systemd or traffic_manager.
Inspect header_rewrite configuration files for rules using cookie conditions (%{COOKIE}) or CIDR match operators, which represent the exposed attack surface.

Monitoring Recommendations

Forward ATS diags.log, error.log, and system journal entries to a centralized log platform for correlation.
Monitor upstream latency and 5xx response spikes against request patterns targeting the ATS front end.
Track running versions of Apache Traffic Server across the fleet and alert when unpatched versions appear.

How to Mitigate CVE-2026-58184

Immediate Actions Required

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 as published by the Apache Software Foundation.
Identify all ATS nodes loading the header_rewrite plugin and prioritize them for patching.
Review header_rewrite rulesets and remove or restrict rules that reference cookies or CIDR conditions until patched.

Patch Information

The Apache Software Foundation released fixed versions 9.2.15 and 10.1.4. Version branch 8.x reaches end of maintenance without a fix in the published notice, so operators on 8.0.0–8.1.9 must migrate to a supported branch. See the Apache Mailing List Discussion for the maintainer announcement.

Workarounds

Temporarily unload the header_rewrite plugin from plugin.config if it is not required for production traffic.
Remove cookie-based and CIDR-based conditions from header_rewrite rules until the upgrade is applied.
Place a filtering layer or Web Application Firewall (WAF) upstream of ATS to strip malformed cookie headers.

bash

# Verify installed Apache Traffic Server version
traffic_server -V

# Example: disable header_rewrite in plugin.config until patched
# (comment out the plugin line, then reload)
# header_rewrite.so etc/trafficserver/rewrite.conf
sudo traffic_ctl config reload