Apache TS ESI: Recursion Fetch Attacker URLs (v8-8.1.9/9-9.2.14/10-10.1.3)
CVE-2026-58178 Published on July 29, 2026

Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery
The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-58178 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Weakness Type

What is a Stack Exhaustion Vulnerability?

The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.

CVE-2026-58178 has been classified to as a Stack Exhaustion vulnerability or weakness.


Products Associated with CVE-2026-58178

Want to know whenever a new CVE is published for Apache Traffic Server? stack.watch will email you.

 

Affected Versions

Apache Software Foundation Apache Traffic Server: