Description
Apache Traffic Server reads out of bounds while parsing DNS answers.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.



Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Published: 2026-07-29
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Out-of-bounds read, potential memory corruption
Action: Apply Patch
AI Analysis

Impact

Apache Traffic Server reads out of bounds while parsing DNS answers, a flaw classified as CWE‑125. This allows an attacker to read memory beyond the intended buffer, potentially exposing confidential data or causing the server to crash. The vulnerability could lead to information disclosure or denial‑of‑service on the affected host.

Affected Systems

The flaw exists in Apache Software Foundation’s Apache Traffic Server in all releases from 8.0.0 to 8.1.11, from 9.0.0 to 9.2.14, and from 10.0.0 to 10.1.3.

Risk and Exploitability

The CVSS score is 6.3, indicating moderate severity, and the EPSS probability is less than 1 %, implying a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is remote: an adversary can send crafted DNS responses that reach the Traffic Server instance—either directly or via a spoofed upstream resolver—to trigger the out‑of‑bounds read.

Generated by OpenCVE AI on October 1, 2026 at 23:13 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache Traffic Server to version 9.2.15 or newer, or 10.1.4 or newer, where the issue is resolved.
  • Restrict DNS traffic to the Traffic Server so that only trusted upstream resolvers are allowed to provide DNS responses, using firewall or access‑control rules.
  • Monitor DNS traffic and server logs for anomalous responses or crashes, and apply security patches promptly as part of the patch‑management cycle.

Generated by OpenCVE AI on October 1, 2026 at 23:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Thu, 30 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 29 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache traffic Server
Vendors & Products Apache
Apache traffic Server

Wed, 29 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Description Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Title Apache Traffic Server: Out-of-bounds reads while parsing DNS responses
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Apache Traffic Server
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-01T17:00:30.097Z

Reserved: 2026-06-29T15:49:51.058Z

Link: CVE-2026-58160

cve-icon Vulnrichment

Updated: 2026-07-29T12:14:42.455Z

cve-icon NVD

Status : Modified

Published: 2026-07-29T10:16:41.637

Modified: 2026-10-01T18:17:23.967

Link: CVE-2026-58160

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T23:15:16Z

Weaknesses