CVE-2025-58136

High

Description

A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12. Users are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue. A workaround for older versions is to set proxy.config.http.request_buffer_enabled to 0 (the default value is 0).

SeverityHigh

CVSS7.5

Exploit probability—

Product

Apache Traffic Server

PublishedApr 2, 2026

First seenApr 2, 2026

Weakness typeCWE-670CWE-670

How to fix

Update

apache traffic_server9.2.13, 10.1.2 or later

Vendor advisories

lists.apache.org/thread/2s11roxlv1j8ph6q52rqo1klvl01n14q

Affected products

Product	Affected versions	Fixed in
apache traffic_server	9.0.0 ≤ v < 9.2.13, 10.0.0 ≤ v < 10.1.2	9.2.13, 10.1.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.