PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-58151 Apache Software Foundation CVE debrief

Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. The vulnerability allows for a crash or resource exhaustion through abusive HTTP/2 framing and flow-control, with affected versions including 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Upgrades to 9.2.15 or 10.1.4 are recommended to mitigate this high impact issue, highlighted by a high CVSS score of 8.7. Evidence from the CVE record and NVD entry supports these details, emphasizing the need for verification of affected deployments and review of official advisories.

Vendor
Apache Software Foundation
Product
Apache Traffic Server
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-29
Original CVE updated
2026-08-03
Advisory published
2026-07-29
Advisory updated
2026-08-03

Who should care

Users of Apache Traffic Server, particularly those using affected versions, should be aware of this vulnerability and take steps to mitigate it. This includes operators of Apache Traffic Server, security teams responsible for vulnerability management, and platform administrators who need to ensure proper configurations and mitigations are in place. Reviewing system configurations, applying patches, and monitoring for potential abuse are crucial steps.

Technical summary

The vulnerability allows for a crash or resource exhaustion of Apache Traffic Server through abusive HTTP/2 framing and flow-control. Affected versions include 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Upgrades to 9.2.15 or 10.1.4 are recommended. This issue can lead to high impact due to its potential for resource exhaustion and crash, highlighted by a high CVSS score of 8.7.

Defensive priority

High priority due to high CVSS score of 8.7 and potential for resource exhaustion.

Recommended defensive actions

  • Upgrade to version 9.2.15 or 10.1.4
  • Review and apply vendor recommendations
  • Monitor for potential abuse of HTTP/2 framing and flow-control
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and recommended upgrades. The issue affects Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4. Evidence limits suggest verifying affected deployments, reviewing official advisories, and tracking exceptions. Defenders should verify system configurations, review logs for potential abuse, and ensure proper mitigations are in place.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-29T09:16:29.327Z and has not been modified since then.