Summary
CVE-2026-58184 is an out-of-bounds write (memory corruption) vulnerability in the header_rewrite plugin of Apache Traffic Server. A remote, unauthenticated attacker can trigger crashes or memory corruption through malformed input processed during cookie operations and CIDR condition matching, resulting primarily in denial of service. The Apache Software Foundation rates it HIGH severity (CVSS v3.1 base score 8.2).
Technical details
- Root cause: An out-of-bounds write (CWE-787) in the
header_rewriteplugin. The flaw resides in the plugin’s handling of cookie operations and CIDR condition matching, where input is processed without adequate bounds enforcement. - Trigger conditions: The vulnerability is exercised when the
header_rewriteplugin processes affected cookie operations or CIDR condition matching against attacker-influenced request data. - Attack vector: Network (AV:N). The issue is reachable remotely, requires low attack complexity, and needs no privileges or user interaction.
- Impact: Process crash and potential memory corruption, leading to service disruption (denial of service). The CVSS vector reflects high availability impact and low confidentiality impact.
Affected software
- Apache Traffic Server 8.0.0 through 8.1.9
- Apache Traffic Server 9.0.0 through 9.2.14
- Apache Traffic Server 10.0.0 through 10.1.3
Severity
- CVSS v3.1 base score: 8.2 (HIGH)
- Vector string:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Mitigation and recommended actions
- Immediate: Upgrade to a fixed release — Apache Traffic Server 9.2.15 or 10.1.4 (or later).
- If patching is not immediately possible: Where operationally feasible, disable or remove use of the
header_rewriteplugin, and avoidheader_rewriterules that rely on cookie operations or CIDR condition matching until the upgrade is applied. Restrict network exposure of affected servers to trusted sources as a compensating control.

