Is CVE-2026-58184 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58184 being exploited in the wild.

How severe is CVE-2026-58184?

High severity, with a CVSS score of 8.2, published 29 July 2026.

Which products and versions are affected?

Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, 10.0.0 through 10.1.3.

Is there a fix for CVE-2026-58184?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-58184 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-58184?

Check whether you run Apache Traffic Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58184: Apache Traffic Server memory corruption in header_rewrite plugin

CVE-2026-58184 · Severity: high · CVSS 8.2 · Published 2026-07-29

Apache Traffic Server, a high-performance web proxy used to manage and speed up internet traffic, contains a flaw in its header modification plugin. An attacker could exploit this to crash the server or potentially corrupt its memory, leading to service outages and impacting the reliability of web operations. Organizations using this software should update to the latest versions to ensure continuous service availability.

Technologies: Apache Traffic Server. Vendors: Apache.

Quick answers

Is CVE-2026-58184 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58184 being exploited in the wild.
How severe is CVE-2026-58184?: High severity, with a CVSS score of 8.2, published 29 July 2026.
Which products and versions are affected?: Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, 10.0.0 through 10.1.3.
Is there a fix for CVE-2026-58184?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-58184 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-58184?: Check whether you run Apache Traffic Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds write vulnerability (CWE-787) exists in the header_rewrite plugin of Apache Traffic Server. The flaw is triggered during specific cookie operations and CIDR condition matching, potentially leading to memory corruption or a process crash. The vulnerability is reachable over the network without authentication. Successful exploitation primarily impacts service availability (DoS) but may also allow for limited information disclosure. Patches are available in versions 9.2.15 and 10.1.4.

Affected products

Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, 10.0.0 through 10.1.3

Timeline

2026-07-29: disclosed
2026-07-29: advisory

References

https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.