Summary
CVE-2026-58189 is a Server-Side Request Forgery (SSRF) vulnerability in Apache Traffic Server caused by a redirect-limit bypass. When plugins reset the internal retry counter, the configured redirect limit can be circumvented, enabling SSRF amplification against back-end or third-party services. The issue is rated HIGH severity (CVSS v3.1 base score 7.5).
Technical details
- Root cause: Apache Traffic Server allows a redirect-limit bypass when plugins reset the retry counter, defeating the control that is meant to cap how many redirects a single request will follow.
- Trigger conditions: The retry counter being reset (in the plugin-driven redirect handling path) permits the redirect limit to be exceeded, allowing a request to be redirected repeatedly beyond the intended bound.
- Attack vector: Network-based (AV:N), requiring no authentication, no privileges, and no user interaction.
- Impact: SSRF amplification — an attacker can drive the proxy to issue an outsized volume of amplified redirect-driven requests, resulting in a high availability impact (denial of service). The CVSS vector indicates no confidentiality or integrity impact.
Affected software
- Apache Traffic Server 8.0.0 through 8.1.9
- Apache Traffic Server 9.0.0 through 9.2.14
- Apache Traffic Server 10.0.0 through 10.1.3
Severity
- CVSS v3.1 base score: 7.5 (HIGH)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Mitigation and recommended actions
- Immediate: Upgrade to a fixed release. The 9.x branch is fixed in 9.2.15 and the 10.x branch is fixed in 10.1.4. Users on the 8.x branch should migrate to a supported, fixed release (9.2.15 or later).
- If patching is not immediately possible: Review and restrict the use of plugins that reset the redirect/retry counter, and constrain outbound requests from Traffic Server using network-layer egress controls so the proxy cannot reach unintended internal or external destinations, limiting the SSRF amplification and denial-of-service exposure.

