Quick answers
- Is CVE-2026-58183 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-58183 being exploited in the wild.
- How severe is CVE-2026-58183?
- Medium severity, with a CVSS score of 5.9, published 29 July 2026.
- Which products and versions are affected?
- Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, 10.0.0 through 10.1.3.
- Is there a fix for CVE-2026-58183?
- A patch was published on 2026-07-29. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-58183 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-58183?
- Check whether you run Apache Traffic Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability exists in the prefetch plugin of Apache Traffic Server due to improper input validation (CWE-20). An unauthenticated remote attacker can provide malicious input that triggers a crash in the plugin, resulting in a denial-of-service (DoS) for the affected service. The attack vector is network-based, though the CVSS assessment suggests a high complexity (AC:H), likely due to specific configuration requirements or timing needed to trigger the prefetch logic. The issue is resolved in versions 9.2.15 and 10.1.4.
Affected products
- Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, 10.0.0 through 10.1.3
Timeline
- 2026-07-29: disclosed
- 2026-07-29: advisory
- 2026-07-29: patched