CVE-2026-59173 Details
Description
Uncontrolled Resource Consumption vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.13, from 10.0.0 through 10.1.2. Users are recommended to upgrade to version 9.1.14 or 10.1.3, which fixes the issue.
A denial-of-service vulnerability has been identified in Apache Traffic Server, specifically in the HTTP/2 protocol, where stalled flow-control can be exploited. This issue affects Apache Traffic Server versions 9.0.0 prior to 9.1.14 and 10.0.0 prior to 10.1.3.
Users of Apache Traffic Server 9.x should upgrade to version 9.1.14 or later. Users of Apache Traffic Server 10.x should upgrade to version 10.1.3 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/07/17/5 | CVE | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/lhlbhphmv5dsfgx1fx84mgonzbocpzhd | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache traffic server | >= 9.0.0, < 9.2.14 >= 10.0.0, < 10.1.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 18, 2026 | CVE Modified | CVE |
| Jul 18, 2026 | New CVE Received | [email protected] |