CVE-2025-58136: A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0…

high7.5CVSS 3.1

AVNACLPRNUINSUCNINAH

A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12. Users are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue. A workaround for older versions is to set proxy.config.http.request_buffer_enabled to 0 (the default value is 0).

Affected

6 ranges

Vendor	Product	Version range	Fixed in
apache	traffic_server	>= 10.0.0 < 10.1.2	10.1.2
apache	traffic_server	>= 9.0.0 < 9.2.13	9.2.13
apache_software_foundation	apache_traffic_server	10.0.0 – 10.1.1	—
apache_software_foundation	apache_traffic_server	9.0.0 – 9.2.12	—
debian	trafficserver	< trafficserver 9.2.5+ds-0+deb12u4 (bookworm)	trafficserver 9.2.5+ds-0+deb12u4 (bookworm)
yiisoft	yii2	>= 0 < 2.0.52	2.0.52

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

ghsa9.1CRITICAL

osv7.5HIGH

cisa9.8CRITICAL