CVE-2026-58186 HIGH

CVE-2026-58186: Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses

Vendor Apache Software Foundation
Product Apache Traffic Server
Weakness CWE-20 · Input validation
Published July 29, 2026
Last update July 29, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Key dates

02Disclosure timeline

July 29, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2024-1534 Booster for WooCommerce <= 7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde CVE-2024-13691 Uncode <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary File Read in uncode_recordMedia CVE-2026-15288 SureForms – Drag and Drop Form Builder for WordPress <= 2.2.1 - Unauthenticated Stripe Payment Amount Manipulation CVE-2025-13587 Two Factor (2FA) Authentication via Email <= 1.9.8 - Two-Factor Authentication Bypass via token CVE-2025-12718 Quick Contact Form <= 8.2.6 - Unauthenticated Open Mail Relay