CVE-2026-58185 is a medium severity flaw (CVSS 5.9) in Apache Traffic Server. The intercept plugin has a use-after-free, and it affects versions 8.0.0 through 10.1.3. Apache recommends upgrading to 9.2.15 or 10.1.4 to fix it, and the same release covers its sibling CVEs.
What's affected
- Apache Traffic Server 8.0.0 through 8.1.11.
- Apache Traffic Server 9.0.0 through 9.2.14.
- Apache Traffic Server 10.0.0 through 10.1.3.
- Fixed versions: 9.2.15 and 10.1.4.
How to check if you're exposed
Run traffic_server -V and compare. Check whether your configuration loads the intercept plugin. The upgrade also covers other Traffic Server CVEs in the same Apache announcement.
Safeguard does not replace the vendor advisory for packaged software like this, but the Gold directory is a quick place to look up the CVE record and see related advisories. If your own code bundles components from this product family, the free scan at gold.safeguard.sh/scan can list them.
What to do now
- Upgrade to 9.2.15 or 10.1.4.
- Restart and confirm the version.
- Plan a move off 8.x.
After the update, confirm the new version in the product itself, then repeat the check on every environment, including staging and disaster recovery copies. Those copies are the ones most often left behind, and an old copy on a reachable network is still an open door.
Why it matters
CWE-416 (Use After Free) means memory is used after it has been freed. The record scores impact as availability only, so the expected outcome is a crash, though use-after-free bugs are sometimes more serious.
The CISA KEV flag is false.
When a medium score and a high score share a fix, the fix drives the schedule. Do not hold this one back because of its lower number.
Quick check
Why is the score lower than the other Traffic Server CVEs?
The record lists only an availability impact.
Sources
Last reviewed: 19 October 2026.
