Vulnerability · Published Apr 2, 2026 · Assigned by apache

CVE-2025-58136Apache Traffic Server: A simple legitimate POST request causes a crash

High 7.5

In plain English

A high-severity security flaw in Apache Traffic Server from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.7%top 46.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12. Users are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue. A workaround for older versions is to set proxy.config.http.request_buffer_enabled to 0 (the default value is 0).

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	trafficserver	9.2.5+ds-0+deb12u4	DEBIAN-CVE-2025-58136
Ubuntu:24.04:LTS	trafficserver	no fix listed	UBUNTU-CVE-2025-58136
Ubuntu:25.10	trafficserver	no fix listed	UBUNTU-CVE-2025-58136

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Traffic Server	10.0.0 – through 10.1.19.0.0 – through 9.2.12

Weakness: CWE-670 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://lists.apache.org/thread/2s11roxlv1j8ph6q52rqo1klvl01n14q vendor-advisory