CVE-2025-58136
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A bug in POST request handling causes a crash under a certain condition in Apache Traffic Server versions 10.0.0 through 10.1.1 and 9.0.0 through 9.2.12. The issue is fixed in versions 10.1.2 and 9.2.13. A workaround for older versions is to set proxy.config.http.request_buffer_enabled to 0.
Risk Assessment
A crash of the proxy server can lead to service disruption, affecting the availability of web applications and websites.
Recommendation
Upgrade Apache Traffic Server to version 10.1.2 or 9.2.13. If an upgrade is not possible, set proxy.config.http.request_buffer_enabled to 0.
Other vulnerabilities in Apache Traffic Server
See all- CVE-2017-5659High
Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked encoding.
- CVE-2016-5396High
Apache Traffic Server versions 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack.
- CVE-2014-3525High
Unspecified vulnerability in Apache Traffic Server versions 3.x through 3.2.5, 4.x before 4.2.1.1, and 5.x before 5.0.1. This vulnerability may be related to health checks, but its impact and attack vectors are unknown.
- CVE-2026-58162Critical
The certifier plugin in Apache Traffic Server generates certificates based on attacker-controlled client SNI. Affects versions 8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3.
- CVE-2026-58155Critical
Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. Affects versions 8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3.
- CVE-2026-58150Critical
Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. Affects versions 8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3.
- CVE-2026-57834Critical
Apache Traffic Server is vulnerable to request smuggling when chunked messages are malformed. This affects versions from 8.0.0 to 8.1.9, from 9.0.0 to 9.2.14, and from 10.0.0 to 10.1.3.
- CVE-2026-41920Critical
Apache Traffic Server has an Improper Access Control vulnerability. This affects versions from 9.0.0 to 9.1.14 and from 10.0.0 to 10.1.3.
- CVE-2026-33267Critical
Apache Traffic Server has an Improper Input Validation vulnerability. This affects versions from 9.2.0 to 9.2.14 and from 10.1.0 to 10.1.3.
- CVE-2023-33934Critical
Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server through version 9.2.1.
Original NVD description (English source)
A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12. Users are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue. A workaround for older versions is to set proxy.config.http.request_buffer_enabled to 0 (the default value is 0).