Denial of Service Vulnerability in Apache Traffic Server ESI Plugin
CVE-2026-58178

8.2HIGH

Key Information:

Vendor

Apache
Status
Apache Traffic Server
Vendor
CVE Published:
29 July 2026

What is CVE-2026-58178?

The Apache Traffic Server ESI plugin is susceptible to an issue that allows recursion without limit, which can lead to fetching attacker-controlled URLs. This situation poses a significant risk as it can potentially be exploited for Denial of Service attacks, affecting the performance and availability of the server. It is crucial for users running versions 8.0.0 through 10.1.3 to upgrade to the recommended versions 9.2.15 or 10.1.4 to mitigate this vulnerability.

Affected Version(s)

Apache Traffic Server 8.0.0 <= 8.1.9

Apache Traffic Server 9.0.0 <= 9.2.14

Apache Traffic Server 10.0.0 <= 10.1.3

References

https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnoky...
vendor-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Apache Community
.