Description
The Apache Traffic Server intercept plugin has a use-after-free.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Published: 2026-07-29
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The intercept plugin of Apache Traffic Server contains a use-after-free flaw, identified as CWE-416, which can cause memory corruption.

Affected Systems

Apache Traffic Server released by the Apache Software Foundation is vulnerable in versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

Risk and Exploitability

The CVSS score is 8.2 and the EPSS score is less than 1 %. The vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on August 4, 2026 at 12:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4, which contain a fix for the use-after-free.
  • Until the upgrade can be performed, disable or remove the intercept plugin from affected servers to eliminate the execution path.
  • Restrict inbound traffic to those servers using firewall rules or virtual IPs that limit access to the intercept plugin functionality.
  • Monitor traffic for anomalous requests that may indicate attempts to exploit memory corruption and ensure IDS signatures are updated accordingly.

Generated by OpenCVE AI on August 4, 2026 at 12:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 29 Jul 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache traffic Server
Vendors & Products Apache
Apache traffic Server

Wed, 29 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Description The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Title Apache Traffic Server: Use-after-free in the intercept plugin
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Apache Traffic Server
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-07-29T12:13:02.420Z

Reserved: 2026-06-29T16:29:26.190Z

Link: CVE-2026-58185

cve-icon Vulnrichment

Updated: 2026-07-29T12:12:58.695Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-29T10:16:43.663

Modified: 2026-07-31T20:52:12.160

Link: CVE-2026-58185

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T12:45:05Z

Weaknesses