CVE-2026-58153 in Traffic Server

Résumé

par MITRE • 29/07/2026

Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1.

This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Responsable: Apache
• Réserver: 29/06/2026
• Divulgation: 29/07/2026
• Modérer: accepté
• Entrée: VDB-384091
• CPE: prêt
• CWE: CWE-20 (confirmé)
• CVSS: 10.0 (VulDB)
• EPSS: 0.00000
• KEV: non
• Activités: très faible

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-58153
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-58153
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-58153/