CVE-2026-58155
Apache Traffic Server can truncate very long header names, which lets attackers create duplicate headers, smuggle requests, and bypass security policies. This flaw exists in versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Upgrading to 9.2.15 or 10.1.4 removes the vulnerability.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Apache Traffic Server versions 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3.
Real-world impact
An attacker could use header aliasing and request smuggling to bypass security controls, potentially gaining unauthorized access or executing malicious actions.
Why this severity
The CVSS score of 9.2 reflects the high impact of the vulnerability: it allows attackers to bypass security policies and smuggle requests without authentication or user interaction, making it a critical flaw.
What to do about it
- 01Upgrade Apache Traffic Server to version 9.2.15 or later, or to 10.1.4 or later.
- 02Restart the Traffic Server service to apply the update.
NVD-referenced vendor advisory
Timeline
- Jul 29, 2026 · 1d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.