CVE-2026-59173

EUVD-2026-45376
Uncontrolled Resource Consumption vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 9.0.0 through 9.1.13, from 10.0.0 through 10.1.2.

Users are recommended to upgrade to version 9.1.14 or 10.1.3, which fixes the issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Debian logo
Debian Releases
Debian Product
Codename
trafficserver
bookworm
postponed
bookworm (security)
vulnerable
bullseye
postponed
bullseye (security)
vulnerable
sid
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
trafficserver
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
dne
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://lists.apache.org/thread/lhlbhphmv5dsfgx1fx84mgonzbocpzhd
http://www.openwall.com/lists/oss-security/2026/07/17/5