by Kastro
Paper/Archive/CVE-2026-58185

CVE-2026-58185

Apache Software Foundation Apache Traffic Server — Apache Traffic Server: Use-after-free in the intercept plugin

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 47.4.474 × 209.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Affected

ProductAffectedFixed inSource
Apache Traffic Server8.0.0 – 8.1.11–CNA
Apache Traffic Server9.0.0 – 9.2.14–CNA
Apache Traffic Server10.0.0 – 10.1.3–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
apache (CNA)8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
apache (CNA)5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

advisorylists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d