by Kastro
Paper/Archive/CVE-2026-58161

CVE-2026-58161

Apache Software Foundation Apache Traffic Server — Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server

EPSS 0.7%CVSS 9.2
critical.is priorityof 100
38
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 51.6.516 × 2010.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Affected

ProductAffectedFixed inSource
Apache Traffic Server8.0.0 – 8.1.11–CNA
Apache Traffic Server9.0.0 – 9.2.14–CNA
Apache Traffic Server10.0.0 – 10.1.3–CNA

Scores by source

apache (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
apache (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisorylists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d