Description
Apache Traffic Server reads out of bounds while parsing DNS answers.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Published: 2026-07-29
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Apache Traffic Server parses DNS answers and performs an out‑of‑bounds read, a memory corruption flaw categorized as CWE‑125. The defect allows an attacker to read memory beyond intended buffers, potentially exposing internal data or causing a crash. Depending on the attacker’s goals, this can lead to unintended disclosure of sensitive information or a denial‑of‑service on the affected host.

Affected Systems

The flaw exists in Apache Software Foundation’s Apache Traffic Server in all releases from 8.0.0 to 8.1.9, from 9.0.0 to 9.2.14, and from 10.0.0 to 10.1.3.

Risk and Exploitability

The CVSS score is 6.3, indicating moderate severity, and the EPSS probability is less than 1 %, implying a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is remote: an adversary can send crafted DNS responses that reach the Traffic Server instance—either directly or via a spoofed upstream resolver—to trigger the out‑of‑bounds read.

Generated by OpenCVE AI on August 4, 2026 at 12:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Apache Traffic Server to version 9.2.15 or newer, or 10.1.4 or newer, where the issue is resolved.
  • Restrict DNS traffic to the Traffic Server so that only trusted upstream resolvers are allowed to provide DNS responses, using firewall or access‑control rules.
  • Monitor DNS traffic and server logs for anomalous responses or crashes, and apply security patches promptly as part of the patch‑management cycle.

Generated by OpenCVE AI on August 4, 2026 at 12:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 30 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 29 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache traffic Server
Vendors & Products Apache
Apache traffic Server

Wed, 29 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Description Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Title Apache Traffic Server: Out-of-bounds reads while parsing DNS responses
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Apache Traffic Server
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-07-29T12:14:46.499Z

Reserved: 2026-06-29T15:49:51.058Z

Link: CVE-2026-58160

cve-icon Vulnrichment

Updated: 2026-07-29T12:14:42.455Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-29T10:16:41.637

Modified: 2026-08-03T19:36:23.700

Link: CVE-2026-58160

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T12:45:05Z

Weaknesses