CVE-2026-58179 is a high severity flaw (CVSS 8.1) in Apache Traffic Server. The regex_remap plugin overflows the stack and integers from substitution input. It affects 8.0.0 through 10.1.3, and the recommended fix is to upgrade to 9.2.15 or 10.1.4 on every affected host.
What's affected
- Apache Traffic Server 8.0.0 through 8.1.11.
- Apache Traffic Server 9.0.0 through 9.2.14.
- Apache Traffic Server 10.0.0 through 10.1.3.
- Fixed versions: 9.2.15 and 10.1.4.
How to check if you're exposed
Run traffic_server -V to get the version. Then search your remap configuration for regex_remap to see whether the plugin is loaded. Patch regardless, because the record lists the whole version range as affected.
Safeguard does not replace the vendor advisory for packaged software like this, but the Gold directory is a quick place to look up the CVE record and see related advisories. If your own code bundles components from this product family, the free scan at gold.safeguard.sh/scan can list them.
What to do now
- Upgrade to 9.2.15 or 10.1.4.
- Move off 8.x, for which the record names no fix.
- Review regex_remap rules and substitutions after the upgrade.
After the update, confirm the new version in the product itself, then repeat the check on every environment, including staging and disaster recovery copies. Those copies are the ones most often left behind, and an old copy on a reachable network is still an open door.
Why it matters
This is CWE-121 (Stack-based Buffer Overflow), a stack based buffer overflow, here driven by the substitution input. Stack overflows can corrupt control data, which is why the record rates impact on confidentiality, integrity and availability as high.
The CISA KEV flag is false.
A single Apache announcement covers several Traffic Server fixes, so reading the thread once and planning one upgrade is better than treating each CVE as a separate ticket.
Quick check
Is the plugin on by default?
The record does not say. Check your own remap configuration.
Sources
Last reviewed: 19 October 2026.
