CVE-2026-58179
A stack overflow in Apache Traffic Server’s regex_remap plugin can be triggered by malformed substitution input, allowing attackers to run arbitrary code. The flaw exists in several major releases and can be fixed by upgrading to the latest patched versions.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Apache Traffic Server versions 8.0.0‑8.1.9, 9.0.0‑9.2.14, and 10.0.0‑10.1.3. Users running these versions on web‑proxy or caching servers are affected.
Real-world impact
An attacker who can send crafted requests to the server could exploit the overflow to execute code with the server’s privileges, potentially taking full control of the machine and compromising all data handled by the server.
Why this severity
The CVSS score of 9.2 reflects a low attack complexity, no user interaction, and the vulnerability’s ability to compromise confidentiality, integrity, and availability of the affected system.
What to do about it
- 01Upgrade Apache Traffic Server to version 9.2.15 or later, or to 10.1.4 or later.
NVD-referenced vendor advisory
Timeline
- Jul 29, 2026 · 1d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.