CVE-2026-58187: Apache Traffic Server DoS Vulnerability

CVE-2026-58187 Overview

CVE-2026-58187 is an out-of-bounds write vulnerability [CWE-787] in the Apache Traffic Server multiplexer plugin. The plugin overruns its chunk-decode buffer when processing upstream input, leading to denial of service. The flaw affects Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Apache recommends upgrading to 9.2.15 or 10.1.4 to remediate the issue. The vulnerability is network-reachable and requires no authentication, though exploitation depends on the multiplexer plugin being enabled and passing attacker-influenced chunked responses.

Critical Impact
A remote attacker can trigger a buffer overrun in the multiplexer plugin using crafted chunked upstream responses, causing the Apache Traffic Server process to crash and denying service to downstream clients.

Affected Products

Apache Traffic Server 8.0.0 through 8.1.9
Apache Traffic Server 9.0.0 through 9.2.14
Apache Traffic Server 10.0.0 through 10.1.3

Discovery Timeline

2026-07-29 - CVE-2026-58187 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-58187

Vulnerability Analysis

Apache Traffic Server is a reverse and forward proxy cache used in high-throughput content delivery environments. The multiplexer plugin duplicates client requests to multiple upstream origins and processes their responses. The vulnerability lies in how the plugin decodes HTTP chunked transfer-encoding data returned from upstream servers.

The plugin writes decoded chunk data into a fixed-size buffer without adequately validating that the incoming chunk length fits within the buffer boundary. When the decoder receives chunk sizes or payload sequences that exceed the destination capacity, it writes past the end of the buffer. This out-of-bounds write [CWE-787] corrupts adjacent memory and typically crashes the Traffic Server worker process.

Root Cause

The root cause is insufficient bounds checking in the chunk-decode path of the multiplexer plugin. The decoder trusts length metadata derived from upstream input and copies payload bytes into a chunk-decode buffer sized for expected traffic patterns. Attacker-controlled or malformed upstream responses violate that assumption, producing a linear buffer overrun.

Attack Vector

Exploitation requires an attacker to influence an upstream response that the multiplexer plugin processes. This can occur when Traffic Server proxies to an origin an attacker controls, when an upstream is compromised, or when a machine-in-the-middle can inject or modify a chunked response. The attacker sends a chunked HTTP response containing malformed chunk sizes or oversized payload segments. When the plugin decodes the response, the overrun corrupts memory and terminates the process, resulting in denial of service for all traffic served by the affected instance.

No verified public exploit code is available. The Apache security mailing list thread referenced in the advisory provides additional technical context. See the Apache Security Mailing List Thread for details.

Detection Methods for CVE-2026-58187

Indicators of Compromise

Unexpected traffic_server process crashes, segmentation faults, or restarts recorded in system logs or traffic.out.
Core dump artifacts referencing the multiplexer plugin call stack or chunk-decode routines.
Bursts of upstream responses containing anomalous Transfer-Encoding: chunked framing, oversized chunk-size declarations, or truncated chunk payloads.
Elevated 5xx error rates or connection resets from Traffic Server instances running the multiplexer plugin.

Detection Strategies

Inventory Traffic Server deployments and identify hosts running the multiplexer plugin against versions listed in the advisory.
Enable and monitor Traffic Server diagnostic logs for plugin faults and abnormal exits.
Deploy web application firewall or reverse-proxy rules that inspect upstream chunked responses for malformed framing before they reach the plugin.

Monitoring Recommendations

Alert on process restarts of traffic_server and correlate with concurrent upstream response patterns.
Track availability metrics on Traffic Server pools to identify service disruption trends consistent with repeated crashes.
Ingest Traffic Server logs into a centralized SIEM and build detections for repeated plugin-related crash signatures.

How to Mitigate CVE-2026-58187

Immediate Actions Required

Upgrade Apache Traffic Server to 9.2.15 or 10.1.4 on all affected hosts.
If immediate patching is not feasible, disable the multiplexer plugin until the upgrade can be completed.
Restrict upstream origins to trusted, authenticated endpoints and validate their TLS chains to reduce the risk of injected chunked responses.

Patch Information

Apache Traffic Server versions 9.2.15 and 10.1.4 remediate the buffer overrun in the multiplexer plugin's chunk-decode path. Users on the 8.x branch, which is affected through 8.1.9, should migrate to a supported fixed branch. Refer to the Apache Security Mailing List Thread for release notes and upgrade guidance.

Workarounds

Remove or comment out the multiplexer plugin entry in plugin.config and reload Traffic Server.
Route sensitive or high-availability traffic through Traffic Server instances that do not load the multiplexer plugin.
Terminate Transfer-Encoding: chunked at an upstream reverse proxy that normalizes responses before they reach the multiplexer plugin.

bash

# Disable the multiplexer plugin in plugin.config, then reload
sudo sed -i 's/^multiplexer.so/#multiplexer.so/' /etc/trafficserver/plugin.config
sudo traffic_ctl config reload

# Verify fixed version after upgrade
traffic_server -R 1 -V