CVE-2026-58163 is a high severity flaw (CVSS 7.5) in Apache Traffic Server. It mishandles on-disk cache fields and object lifetimes, which can corrupt state or crash the server. Affected releases span 8.0.0 to 10.1.3. Apache recommends upgrading to 9.2.15 or 10.1.4.
What's affected
- Apache Traffic Server 8.0.0 through 8.1.11.
- Apache Traffic Server 9.0.0 through 9.2.14.
- Apache Traffic Server 10.0.0 through 10.1.3.
- Fixed versions: 9.2.15 and 10.1.4. For 8.x, the record gives no fixed release, so move to a supported line.
How to check if you're exposed
Run traffic_server -V on each host and read the version. Anything in the ranges above needs the update. The Apache announcement thread covers this CVE with several others fixed in the same releases.
Safeguard does not replace the vendor advisory for packaged software like this, but the Gold directory is a quick place to look up the CVE record and see related advisories. If your own code bundles components from this product family, the free scan at gold.safeguard.sh/scan can list them.
What to do now
- Upgrade to 9.2.15 or 10.1.4.
- Plan a move off 8.x if you still run it, since no 8.x fix is named in the record.
- Restart the service and confirm the version.
- Watch for crashes or odd cache behavior until you finish upgrading.
After the update, confirm the new version in the product itself, then repeat the check on every environment, including staging and disaster recovery copies. Those copies are the ones most often left behind, and an old copy on a reachable network is still an open door.
Why it matters
The record classes this as CWE-502 (Deserialization of Untrusted Data), which is about trusting stored data without validating it. Here that data is cache fields read from disk. Bad values can corrupt state, and the object lifetime errors can crash the process.
The CISA KEV flag is false.
Traffic Server is often deployed as a fleet of identical edge nodes. Roll the upgrade out one node at a time and watch cache hit rates and error rates, since a cache that restarts empty can shift load onto your origin servers.
Quick check
Is this the same release as the other Traffic Server CVEs?
Several CVEs in this series point at the same Apache thread and fixed versions, so one upgrade covers them.
Sources
Last reviewed: 19 October 2026.
