High

Memory corruption in Apache Traffic Server header_rewrite plugin

IdentifiersCVE-2026-58184CWE-787· Out-of-bounds Write

CVE-2026-58184 is a memory-safety vulnerability in the Apache Traffic Server header_rewrite plugin. The flaw can be triggered during cookie operations and CIDR condition matching, leading to process crashes or memory corruption. Affected versions are Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Available classification information maps the issue to CWE-787, indicating an out-of-bounds write condition.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can crash Apache Traffic Server or corrupt process memory within the header_rewrite plugin. Based on the available severity information, the primary impact is high availability loss, with limited confidentiality impact also noted. Memory corruption also raises the possibility of more severe consequences depending on exploitability and runtime conditions, but specific code-execution impact is not established by the available information.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure by disabling or avoiding use of the header_rewrite plugin functionality associated with cookie operations and CIDR condition matching where operationally feasible. Limit untrusted traffic paths that can reach affected rewrite logic and monitor for crashes or instability until upgrades can be applied. No complete mitigation short of upgrading is currently available from the provided information.

Remediation

Patch, then assume compromise.

Upgrade Apache Traffic Server to a fixed release. Recommended fixed versions are 9.2.15 or later for supported 9.x deployments and 10.1.4 or later for supported 10.x deployments. Affected 8.x installations should be moved to a supported fixed branch because versions through 8.1.9 are affected.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Apache Software FoundationTraffic Serverapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

cvefeed high severityNews

Jul 29, 2026

CVE-2026-58184 - Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory

A memory corruption / crash vulnerability in the Apache Traffic Server header_rewrite plugin triggered during cookie operations and CIDR condition matching.

lists apacheNews

Jul 28, 2026

[SECURITY] Multiple vulnerabilities fixed in Apache Traffic Server 9.2.15 and 10.1.4-Apache Mail Archives

A memory corruption vulnerability in the Apache Traffic Server header_rewrite plugin during cookie operations and CIDR condition matching.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-58184

NVD

nvd.nist.gov/vuln/detail/CVE-2026-58184

MITRE CWE · CWE-787

Out-of-bounds Write

Vendor Advisory

lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d

Memory corruption in Apache Traffic Server header_rewrite plugin

IdentifiersCVE-2026-58184CWE-787· Out-of-bounds Write