PT-2026-29792 · Apache · Apache Traffic Server

Published 2026-04-02 · Updated 2026-05-22 · CVE-2025-58136

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 10.0.0 through 10.1.1, and versions 9.0.0 through 9.2.12

Description A flaw in how POST requests are processed can lead to a system crash.

Recommendations Upgrade to version 10.1.2 Upgrade to version 9.2.13 Set proxy.config.http.request buffer enabled to 0

Fix

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2025-58136

OESA-2026-2383

OESA-2026-2384

OESA-2026-2385

Affected Products

Apache Traffic Server

References · 19

• https://lists.apache.org/thread/2s11roxlv1j8ph6q52rqo1klvl01n14q · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-58136 · Security Note
• https://ubuntu.com/security/CVE-2025-58136 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2384 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2383 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58136 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-65114 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-58136 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-58136 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-58136 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2385 · Vendor Advisory
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2384 · Note
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2385 · Note
• https://twitter.com/syedaquib77/status/2041125709213573352 · Twitter Post
• https://twitter.com/syedaquib77/status/2041132540505776183 · Twitter Post