PT-2026-65733 · Apache · Apache Traffic Server

Apache Community + 1 · CVE-2026-58156 · Published 2026-07-29 · Updated 2026-07-29

NVD

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-58156

Affected Products

Apache Traffic Server

References · 2

• https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-58156 · Security Note