Description
Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.



Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Published: 2026-07-29
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Potential Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Apache Traffic Server mishandles PROXY protocol input, truncating port values and overflowing the stack. The stack overflow can corrupt memory and potentially allow an attacker to execute arbitrary code with the privileges of the Traffic Server process.

Affected Systems

Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are affected. These include the mainstream 8.x, 9.x, and 10.x releases maintained by the Apache Software Foundation.

Risk and Exploitability

The CVSS score is 8.2, indicating high severity, while the EPSS score is less than 1%, suggesting a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote connection that includes a PROXY protocol header. Attackers could send a crafted PROXY message to a Traffic Server instance that accepts the protocol, triggering the stack overflow and potentially achieving code execution.

Generated by OpenCVE AI on October 1, 2026 at 23:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Apache Traffic Server 9.2.15 or 10.1.4, which contain the fix for the PROXY protocol parsing issue.
  • Disable the PROXY protocol or restrict it to trusted interfaces if it is not required for your deployment, reducing the attack surface.
  • Monitor Traffic Server logs for abnormal PROXY protocol headers and perform regular vulnerability scans.

Generated by OpenCVE AI on October 1, 2026 at 23:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Thu, 30 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache traffic Server
Vendors & Products Apache
Apache traffic Server

Wed, 29 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 29 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Description Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Title Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow
Weaknesses CWE-121
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Apache Traffic Server
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-01T16:59:46.758Z

Reserved: 2026-06-29T15:48:04.596Z

Link: CVE-2026-58158

cve-icon Vulnrichment

Updated: 2026-07-29T12:15:29.411Z

cve-icon NVD

Status : Modified

Published: 2026-07-29T10:16:41.347

Modified: 2026-10-01T17:17:29.060

Link: CVE-2026-58158

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T00:00:15Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow