CVE-2025-58136
Apache Traffic Server 9.0.0 – 9.2.13
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-58136 is a high-severity Always-Incorrect Control Flow Implementation (CWE-670) vulnerability in Apache Traffic Server. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 49th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-58136 is a vulnerability in Apache Traffic Server stemming from a bug in POST request handling that causes a crash under certain conditions. It affects versions 10.0.0 through 10.1.1 and 9.0.0 through 9.2.12.
An unauthenticated remote attacker with network access can exploit this issue with low complexity and no user interaction required, resulting in a denial-of-service condition via application crash. The CVSS v3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with the impact limited to high availability disruption and associated with CWE-670 (Always-Infinite Loop).
The Apache advisory, detailed in the mailing list announcement at https://lists.apache.org/thread/2s11roxlv1j8ph6q52rqo1klvl01n14q, recommends upgrading to fixed versions 10.1.2 or 9.2.13. A workaround for unpatched versions is to set proxy.config.http.request_buffer_enabled to 0, which is the default value.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209188
Vulnerability Data
A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12. Users are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the…
more
issue. A workaround for older versions is to set proxy.config.http.request_buffer_enabled to 0 (the default value is 0).
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V9.2.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation at post-design stages directly exercises control-flow paths and reveals mismatches between implemented and intended behavior.
Requiring a documented development process and supporting tools reduces the chance that incorrect control-flow logic is introduced in the first place.
Flaw identification and remediation processes can locate and correct control-flow errors once they manifest as incorrect runtime behavior.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent incorrect control-flow implementations via reviews, testing, and static analysis.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect paths that deviate from intended logic.
Secure development lifecycle processes can catch incorrect control-flow logic during design and code review.
Secure coding standards and reviews directly target flawed control-flow implementations.
Change-management gates may prevent deployment of flawed logic but do not address the coding defect itself.