CVE-2026-58188

If you run Apache Traffic Server with any experimental plugins enabled, treat this disclosure as a critical priority regardless of the CVSS 8.2 score. The vulnerability cluster affects experimental plugins that contain both memory-safety bugs (heap overflow, use-after-free) and limit-bypass conditions—and the 'experimental' label is misleading from a security architecture standpoint. The key insight is this: experimental plugins execute within ATS's process space, not in any sandbox. A heap overflow in an experimental plugin gives an attacker the same process-level capabilities as the same bug in core ATS code. The experimental label signals lower testing, not lower impact. More concerning is why these bugs clustered together. Memory-safety issues alongside limit-bypass errors in the same disclosure typically means one researcher or toolchain uncovered a shared failure mode across the plugin API boundary. That raises a hard question: if these were found accidentally rather than through systematic review, what other experimental plugins harbor latent issues? The experimental label suggests nobody has been systematically auditing that code surface. For your deployment, you need to answer two questions. First, are any experimental plugins actually running in your ATS instances? Many operators enable plugins aggressively for caching and request handling—check your plugin loading configuration and logs for any plugin marked experimental in the documentation. Second, if you do run these plugins, the upgrade path is complicated: ATS 9.2.15 and 10.1.4 contain the fixes, but experimental plugins frequently get rewritten or deprecated across major versions rather than carefully ported. Upgrading may break your plugin's functionality, creating a perverse incentive to stay vulnerable. The practical risk model depends on whether a plugin crash can escalate to code execution in your environment, or whether it's limited to denial of service. The CVSS score doesn't answer this—evaluate your specific plugin chain to determine if you're facing DoS or RCE.

Reviewed through automated stages and approved by a human before publication.