Review reviewHigh

CVE-2025-58136

Apache Software Foundation Apache Traffic Server, traffic server

A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12. Users are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue. A workaround for older versions is to set proxy.config.http.request_buffer_enabled to 0 (the default value is 0).

CVSS: 7.5
EPSS: 0.67%
CISA KEV: Not listed
Published: 2026.04.03

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.67%

Technical severityCVSS 7.5

Vulnerability overview

Affected product and versions

Product: Apache Software Foundation Apache Traffic Server, traffic server
Affected versions: >= 10.0.0 <= 10.1.1, >= 9.0.0 <= 9.2.12, >= 9.0.0 < 9.2.13, >= 10.0.0 < 10.1.2
Fixed versions: 9.2.13, 10.1.2

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Apache Software Foundation Apache Traffic Server, traffic server and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-670