Description
A bug in POST request handling causes a crash under a certain condition.

This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12.

Users are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue.

A workaround for older versions is to set proxy.config.http.request_buffer_enabled to 0 (the default value is 0).
Published: 2026-04-02
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a bug in Apache Traffic Server’s handling of POST requests that triggers a crash under a specific condition. The crash leads to a denial of service, allowing an attacker to cause service interruption. The weakness is a denial of service caused by a buffer-related flaw (CWE‑670).

Affected Systems

Apache Traffic Server by the Apache Software Foundation is affected. Versions from 9.0.0 through 9.2.12 and from 10.0.0 through 10.1.1 are vulnerable. The vulnerability exists only in these ranges and is fixed in 9.2.13 and 10.1.2.

Risk and Exploitability

The CVSS score of 7.5 denotes a high severity. The EPSS score is not available, and the vulnerability is not listed in the KEV catalog, suggesting it is not a known exploited vulnerability. The likely attack vector is remote, through an HTTP POST request, which comes from the server’s public interfaces. Exploitation requires sending the crafted POST request to the server; no additional privileges or physical access are needed. Because the problem results in a crash, the impact is a denial of service that can affect availability.

Generated by OpenCVE AI on April 2, 2026 at 21:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Apache Traffic Server to version 10.1.2 or 9.2.13, which contain the fix.
  • If immediate upgrade is not possible, ensure that proxy.config.http.request_buffer_enabled is set to 0 in the configuration file.
  • After applying the patch or configuration change, restart the Traffic Server process and verify that the service is stable.

Generated by OpenCVE AI on April 2, 2026 at 21:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 03 Apr 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache traffic Server
Vendors & Products Apache
Apache traffic Server

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12. Users are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue. A workaround for older versions is to set proxy.config.http.request_buffer_enabled to 0 (the default value is 0).
Title Apache Traffic Server: A simple legitimate POST request causes a crash
Weaknesses CWE-670
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Apache Traffic Server
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-04-02T18:13:21.125Z

Reserved: 2025-08-25T21:36:46.557Z

Link: CVE-2025-58136

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-04-02T17:16:20.933

Modified: 2026-04-03T16:10:23.730

Link: CVE-2025-58136

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-03T09:18:41Z

Weaknesses