CVE-2025-58136

Published Apr 2, 2026

Last updated 2 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-58136 is a denial-of-service (DoS) vulnerability affecting Apache Traffic Server. This flaw stems from a bug in the server's POST request handling mechanism, specifically related to improper control flow implementation and the request buffering process. When certain conditions are met during the processing of POST requests, the server fails to handle the request state correctly, leading to a crash. Unauthenticated remote attackers can exploit this vulnerability by sending specially crafted POST requests over the network, causing Apache Traffic Server instances to terminate unexpectedly. This can disrupt service availability for organizations that rely on Apache Traffic Server for managing their web traffic. Affected versions include Apache Traffic Server 10.0.0 through 10.1.1 and 9.0.0 through 9.2.12.

Description: A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12. Users are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue. A workaround for older versions is to set proxy.config.http.request_buffer_enabled to 0 (the default value is 0).
Source: security@apache.org
NVD status: Analyzed
Products: traffic_server

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

security@apache.org: CWE-670

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "361CCF7A-CB22-4074-A902-779476856482",
            "versionEndExcluding": "9.2.13",
            "versionStartIncluding": "9.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "CA23F0DC-E368-4327-87A1-A0DCD8553AFF",
            "versionEndExcluding": "10.1.2",
            "versionStartIncluding": "10.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.