Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Apache Traffic Server Crash with Certain POST Requests

published 5 months ago

Summary

Apache Traffic Server, a caching and proxying software, is affected by a bug that causes it to crash when handling certain POST requests. This bug exists in versions 10.0.0 through 10.1.1 and 9.0.0 through 9.2.12. To fix this issue, update to version 10.1.2 or 9.2.13, or as a temporary workaround, set a specific configuration option to 0 in older versions.

What to do

Update openeuler trafficserver to version 9.1.4-6.oe2003sp4.

Affected software

Ecosystem	Vendor	Product	Affected versions
openEuler:20.03-LTS-SP4	openeuler	trafficserver	< 9.1.4-6.oe2003sp4 Fix: upgrade to 9.1.4-6.oe2003sp4

Original advisory text

trafficserver security update

Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache.

Security Fix(es):

A bug in POST request handling causes a crash under a certain condition.

This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12.

Users are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue.

A workaround for older versions is to set proxy.config.http.request_buffer_enabled to 0 (the default value is 0).(CVE-2025-58136)

References

https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-58136 Vendor Advisory

Timeline

Published22 May 2026

Updated22 May 2026

First seen22 May 2026

Sources

OESA-2026-2384 · OSV

Track software like this

Free during beta