CVE-2026-59173: Apache Traffic Server DoS Vulnerability

CVE-2026-59173 Overview

CVE-2026-59173 is an Uncontrolled Resource Consumption vulnerability [CWE-400] in Apache Traffic Server. The flaw affects versions 9.0.0 through 9.1.13 and 10.0.0 through 10.1.2. Remote attackers can trigger the condition over the network without authentication or user interaction, exhausting server resources and impairing availability. The Apache Software Foundation has released fixed versions 9.1.14 and 10.1.3 to address the issue.

Critical Impact
Unauthenticated remote attackers can exhaust Apache Traffic Server resources, causing denial of service against high-volume caching proxy deployments.

Affected Products

Apache Traffic Server 9.0.0 through 9.1.13
Apache Traffic Server 10.0.0 through 10.1.2
Fixed in Apache Traffic Server 9.1.14 and 10.1.3

Discovery Timeline

2026-07-18 - CVE-2026-59173 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-59173

Vulnerability Analysis

Apache Traffic Server (ATS) is a widely deployed HTTP caching proxy used to accelerate web traffic and reduce origin load. CVE-2026-59173 is classified under [CWE-400] Uncontrolled Resource Consumption. The vulnerability allows a remote attacker to send crafted requests that force the server to consume disproportionate CPU, memory, or connection resources. Sustained exploitation degrades or halts proxy operations for legitimate clients.

The attack vector is network-based with low complexity. No privileges or user interaction are required. The impact is confined to availability, with no confidentiality or integrity effects.

Root Cause

The root cause is the absence of adequate limits on resources consumed during processing of specific request patterns. Apache Traffic Server does not enforce sufficient bounds on the operation, allowing a client to amplify server-side work relative to the size of the request. Public technical details are limited to the Apache mailing list and OSS-Security discussion referenced by NVD.

Attack Vector

An unauthenticated attacker sends malicious HTTP traffic directly to a vulnerable Traffic Server instance exposed on the network. Because ATS is typically deployed at the network edge as a reverse or forward proxy, exposure is common. Repeated or concurrent requests amplify resource consumption until the server can no longer service legitimate traffic. Refer to the Apache Mailing List Thread and the OpenWall OSS Security Discussion for further technical context.

Detection Methods for CVE-2026-59173

Indicators of Compromise

Sudden spikes in CPU, memory, or file descriptor usage on Apache Traffic Server hosts without a corresponding rise in cache hit rate.
Elevated numbers of concurrent connections or half-open sessions from a limited set of source IP addresses.
Traffic Server error logs showing timeouts, worker thread saturation, or dropped connections.

Detection Strategies

Monitor ATS traffic.out and diags.log for warnings related to resource limits, connection queue depth, and event loop lag.
Correlate proxy latency metrics with request rate to identify amplification patterns where small request volume drives large resource use.
Inspect access logs for repetitive request signatures targeting the same endpoint from unusual clients.

Monitoring Recommendations

Baseline normal request-per-second, CPU, and memory usage per ATS node, then alert on statistically significant deviations.
Forward ATS logs and host telemetry to a centralized analytics platform for cross-node correlation and historical review.
Track upstream origin health separately from ATS health to distinguish origin-driven from proxy-driven degradation.

How to Mitigate CVE-2026-59173

Immediate Actions Required

Upgrade Apache Traffic Server to version 9.1.14 or 10.1.3 as recommended by the Apache Software Foundation.
Inventory all ATS deployments and confirm version, as builds between 9.0.0–9.1.13 and 10.0.0–10.1.2 are vulnerable.
Restrict network exposure of ATS management interfaces and, where feasible, place ATS behind a rate-limiting front-end.

Patch Information

Users running affected releases should upgrade to Apache Traffic Server 9.1.14 or 10.1.3. Both fixed versions are announced through the Apache Mailing List Thread. No workaround substitutes for applying the patched release.

Workarounds

Apply per-client connection and request rate limits at an upstream load balancer or WAF until patches are deployed.
Reduce ATS proxy.config connection and timeout thresholds to bound worker resource use per client.
Block or throttle source IP addresses exhibiting the traffic patterns described in the Indicators of Compromise section.

bash

# Example: verify installed Apache Traffic Server version and upgrade path
traffic_server -V

# Debian/Ubuntu package upgrade example
sudo apt-get update && sudo apt-get install --only-upgrade trafficserver

# Confirm the running version is 9.1.14 or 10.1.3 or later
traffic_ctl server status