# CVE-2026-58187: Apache Traffic Server out-of-bounds write in multiplexer plugin

Source: https://junglewise.ai/threats/cve-2026-58187-apache-traffic-server-out-of-bounds-write-in-multiplexer-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-58187 · Severity: low · CVSS 3.7 · Published 2026-07-29

Apache Traffic Server, a high-performance caching proxy used to manage web traffic, contains a vulnerability in its multiplexer plugin. An attacker can send specific data that causes the software to crash or become unresponsive. This could lead to a temporary disruption of web services and content delivery for organizations using the affected versions.

Technologies: [Apache Traffic Server](https://junglewise.ai/threats/technologies/traffic-server). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-58187 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58187 being exploited in the wild.

**How severe is CVE-2026-58187?** Low severity, with a CVSS score of 3.7, published 29 July 2026.

**Which products and versions are affected?** Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, 10.0.0 through 10.1.3.

**Is there a fix for CVE-2026-58187?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-58187 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-58187?** Check whether you run Apache Traffic Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write vulnerability (CWE-787) exists in the multiplexer plugin of Apache Traffic Server. The flaw is triggered when the plugin processes upstream input, leading to a buffer overrun during chunk-decoding operations. A remote, unauthenticated attacker can exploit this to cause a denial of service (DoS) condition. The vulnerability affects versions 8.x, 9.x, and 10.x, and has been addressed in versions 9.2.15 and 10.1.4.

## Affected products

- Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, 10.0.0 through 10.1.3

## Timeline

- 2026-07-29: disclosed
- 2026-07-29: advisory

## References

- [https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d](https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d)

## Related threats

- [Apache Traffic Server null pointer dereference in request tear-down](https://junglewise.ai/threats/cve-2026-112381-apache-traffic-server-can-crash-with-a-null-pointer-dereference)
- [Apache Traffic Server connection stall with chunked transfer trailers dropped](https://junglewise.ai/threats/cve-2026-111817-apache-traffic-server-can-stall-a-chunked-transfer-that-it)
- [Apache Traffic Server TLS session resumption bypass of client certificate verification](https://junglewise.ai/threats/cve-2026-111815-apache-traffic-server-can-resume-a-tls-session-across-sni)
- [Apache Traffic Server TLS session reuse with mismatched client certificates](https://junglewise.ai/threats/cve-2026-111814-apache-traffic-server-s-default-outbound-session-sharing-policy)
- [Apache Traffic Server origin_server_auth AWS request signing bypass](https://junglewise.ai/threats/cve-2026-111812-apache-traffic-server-s-origin-server-auth-plugin-lets-a-client)