CVE-2026-58177 is a high severity flaw (CVSS 8.1) in the Apache Traffic Server Cripts framework. It has out-of-bounds writes, path traversal and use-after-free errors. It affects versions 10.0.0 through 10.1.3, and Apache says users should upgrade to 10.1.4 to fix all of them.
What's affected
- Apache Traffic Server 10.0.0 through 10.1.3.
- Fixed version: 10.1.4.
How to check if you're exposed
Run traffic_server -V and check for a 10.x version below 10.1.4. Then check whether you use Cripts, the scripting framework, in your configuration. The record does not say that disabling it avoids the flaw, so patch either way.
Safeguard does not replace the vendor advisory for packaged software like this, but the Gold directory is a quick place to look up the CVE record and see related advisories. If your own code bundles components from this product family, the free scan at gold.safeguard.sh/scan can list them.
What to do now
- Upgrade to 10.1.4.
- Restart and confirm the new version.
- Review any Cripts you wrote or deployed for your own paths and file handling.
After the update, confirm the new version in the product itself, then repeat the check on every environment, including staging and disaster recovery copies. Those copies are the ones most often left behind, and an old copy on a reachable network is still an open door.
Why it matters
The main class is CWE-787 (Out-of-bounds Write), an out-of-bounds write. The advisory also lists path traversal and use-after-free. Memory errors in a proxy that handles untrusted traffic deserve prompt patching.
The CISA KEV flag is false.
Cripts is a newer scripting approach in the 10.x line, so older lines do not carry this code. If you are on 9.x you are not affected by this particular CVE, though the sibling CVEs in the same Apache thread may apply.
Quick check
Does this affect 9.x?
Per the record, only 10.0.0 through 10.1.3 are listed.
Sources
Last reviewed: 19 October 2026.
