Executive brief
Apache Traffic Server, a high-performance caching proxy used to deliver web content, contains a flaw that causes it to leak memory when processing specific DNS records. Over time, this memory leakage can exhaust system resources, leading to service slowdowns or complete crashes. This impacts the availability of web services and can disrupt user access to hosted content.
Technical details
A memory leak vulnerability (CWE-401) exists in Apache Traffic Server's HostDB component when handling SRV (Service) records. The vulnerability is triggered during the processing of these records, where memory is not properly released after its effective lifetime. An unauthenticated remote attacker can exploit this over the network to cause gradual memory exhaustion, eventually leading to a denial-of-service (DoS) as the process runs out of available memory. The issue is fixed in versions 9.2.15 and 10.1.4.
Affected products
- Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, 10.0.0 through 10.1.3
Timeline
- 2026-07-29: advisory: Public disclosure of CVE-2026-58175
- 2026-07-29: patched: Fixes released in versions 9.2.15 and 10.1.4