CVE-2025-58136 in Traffic Server
Summary
by MITRE • 04/02/2026
A bug in POST request handling causes a crash under a certain condition.
This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12.
Users are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue.
A workaround for older versions is to set proxy.config.http.request_buffer_enabled to 0 (the default value is 0).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/26/2026
CVE-2025-58136 represents a critical vulnerability in Apache Traffic Server that manifests through improper handling of POST requests under specific conditions. This flaw falls under the category of a denial of service vulnerability where the system crashes when processing certain POST requests, effectively rendering the service unavailable to legitimate users. The vulnerability affects multiple versions of the traffic server software, specifically those in the 10.0.0 through 10.1.1 range and 9.0.0 through 9.2.12 range, indicating a widespread impact across the software's major releases. The technical nature of this issue suggests a memory management or buffer handling problem that occurs during the processing of HTTP POST requests, which is a fundamental operation in web applications. This vulnerability directly impacts the availability aspect of the security triad by causing the server to become unresponsive and crash when encountering specific POST request patterns.
The operational impact of CVE-2025-58136 extends beyond simple service disruption to potentially affect business continuity and user experience. Organizations relying on Apache Traffic Server for content delivery and web proxy services face significant risk when this vulnerability is exploited, as the crash can occur without warning and may require manual intervention to restore service. The vulnerability's condition-specific nature means that attackers could potentially craft malicious POST requests designed to trigger the crash, making this a targeted threat that could be used for service disruption attacks. From a security perspective, this issue represents a weakness in the server's input validation and request handling mechanisms, which are critical components of web infrastructure security. The vulnerability's classification aligns with CWE-122, which deals with heap-based buffer overflow conditions, though the specific manifestation appears to be a crash rather than arbitrary code execution, though both scenarios represent serious security concerns.
The recommended mitigation strategy involves upgrading to the patched versions 10.1.2 or 9.2.13, which contain the necessary code fixes to prevent the crash condition from occurring. These patches likely address the underlying buffer handling or memory management issue that causes the crash during POST request processing, implementing proper bounds checking and request validation. Organizations unable to immediately upgrade can implement a temporary workaround by setting the proxy.config.http.request_buffer_enabled parameter to 0, which effectively disables the problematic request buffering functionality. This workaround, while not a permanent solution, can provide protection for systems running older versions until a proper upgrade can be completed. The workaround itself represents a configuration-based mitigation that reduces the attack surface by disabling a feature that contributes to the vulnerability, though it may also impact performance or functionality of the server. The ATT&CK framework would categorize this vulnerability under the T1499.004 technique for network denial of service, as it specifically targets the availability of network services through crash conditions. Security teams should also consider monitoring for unusual POST request patterns that might indicate exploitation attempts, particularly in environments where the workaround has been implemented and the buffering functionality is disabled.