Description
Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Published: 2026-07-29
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Apache Traffic Server incorrectly processes PROXY protocol input, resulting in truncation of port values and a stack overflow. The stack overflow can corrupt memory and potentially allow an attacker to execute arbitrary code with the privileges of the Traffic Server process.

Affected Systems

Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are affected. These include the mainstream 8.x, 9.x, and 10.x releases maintained by the Apache Software Foundation.

Risk and Exploitability

The CVSS score is 8.2, indicating high severity, while the EPSS score is less than 1%, suggesting a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote connection that includes a PROXY protocol header. Attackers could send a crafted PROXY message to a Traffic Server instance that accepts the protocol, triggering the stack overflow and potentially achieving code execution.

Generated by OpenCVE AI on August 4, 2026 at 12:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Apache Traffic Server 9.2.15 or 10.1.4, which contain the fix for the PROXY protocol parsing issue.
  • Disable the PROXY protocol or restrict it to trusted interfaces if it is not required for your deployment, reducing the attack surface.
  • Monitor Traffic Server logs for abnormal PROXY protocol headers and perform regular vulnerability scans.

Generated by OpenCVE AI on August 4, 2026 at 12:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 30 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache traffic Server
Vendors & Products Apache
Apache traffic Server

Wed, 29 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 29 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Description Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Title Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow
Weaknesses CWE-121
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Apache Traffic Server
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-07-29T12:15:33.223Z

Reserved: 2026-06-29T15:48:04.596Z

Link: CVE-2026-58158

cve-icon Vulnrichment

Updated: 2026-07-29T12:15:29.411Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-29T10:16:41.347

Modified: 2026-08-03T19:38:13.517

Link: CVE-2026-58158

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T12:45:05Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow