CVE-2026-58175 in Traffic Server
Summary
by MITRE • 07/29/2026
Apache Traffic Server leaks memory when handling HostDB SRV records.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
Apache Traffic Server suffers from a memory leak vulnerability when processing HostDB SRV records, representing a critical flaw in the software's resource management capabilities. This vulnerability manifests specifically during the handling of Service Record lookups within the DNS resolution process, where the application fails to properly release allocated memory segments after completing SRV record operations. The issue impacts multiple version ranges including 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3, indicating a persistent problem spanning several major releases of the traffic management software. The memory leak occurs due to improper deallocation of memory structures associated with SRV record caching and resolution operations, leading to gradual accumulation of unreleased memory over time.
The technical implementation flaw stems from inadequate memory management within the HostDB subsystem, which is responsible for DNS caching and resolution services. When Apache Traffic Server encounters SRV records during hostname resolution, it allocates memory for storing the record information but fails to execute proper cleanup routines upon completion of the operation. This memory leak pattern aligns with CWE-401: Improper Release of Memory Before Removing Last Reference, where the application maintains references to memory blocks without properly dereferencing them. The vulnerability operates at the system level within the traffic server's core DNS resolution engine, making it particularly dangerous for high-traffic environments where frequent SRV record lookups occur.
Operationally, this memory leak significantly impacts system stability and performance over extended periods of operation. As the application continues to process SRV records, the accumulated unused memory fragments gradually consume available system resources, eventually leading to degraded performance or complete service unavailability. The issue is particularly concerning for enterprise deployments where Apache Traffic Server serves as a critical component in content delivery networks and web proxy services. Network administrators may observe increasing memory consumption patterns, potential system crashes during peak traffic periods, and overall degradation of caching efficiency. This vulnerability creates conditions that align with ATT&CK technique T1490: Inhibit System Recovery, as the memory exhaustion can lead to service disruption similar to resource exhaustion attacks.
The recommended mitigation involves upgrading to version 9.2.15 or 10.1.4, which contain patched implementations addressing the memory management issue. These updates incorporate proper memory deallocation routines specifically designed for SRV record processing within the HostDB subsystem. The fix ensures that allocated memory segments are correctly released upon completion of SRV record operations, preventing the accumulation of unreleased memory blocks. Organizations should prioritize this upgrade as a critical security measure, particularly in production environments where continuous operation and resource efficiency are paramount. Additionally, system monitoring should be implemented to track memory usage patterns and detect potential recurrence of similar issues in other components of the traffic server infrastructure. The vulnerability demonstrates the importance of proper memory management practices in high-performance network applications and highlights the need for comprehensive testing of resource allocation routines in DNS resolution systems.