This critical-severity CVE scores 9.8 under NVD CVSS v3. EPSS exploit probability: 0.3%, top 75% of all CVEs by exploit prediction. GitHub Security Advisory enrichment pending alignment with NVD CVSS.
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors.
This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 10.1.4, which fix the issue.
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
July 29, 2026
July 31, 2026
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| trafficserver | 8.1.1+ds-1.1 ... 9.2.5+ds-1 (40 versions) | — | — |
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| trafficserver | 9.2.0+ds-2 ... 9.2.5+ds-1 (14 versions) | — | — |
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
Showing the most recent 100 of 235 total refreshes for this CVE.
CWE-787
See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-58177
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.