CVE-2026-58182

EUVD-2026-50227
The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.6 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 20%
Debian logo
Debian Releases
Debian Product
Codename
trafficserver
bookworm
vulnerable
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
sid
vulnerable
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d