by Kastro
Paper/Archive/CVE-2026-58162

CVE-2026-58162

Apache Software Foundation Apache Traffic Server — Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates

EPSS 0.4%CVSS 10.0
critical.is priorityof 100
36
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 29.3.293 × 205.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Affected

ProductAffectedFixed inSource
Apache Traffic Server8.0.0 – 8.1.11–CNA
Apache Traffic Server9.0.0 – 9.2.14–CNA
Apache Traffic Server10.0.0 – 10.1.3–CNA

Scores by source

apache (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
apache (CNA)8.4CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisorylists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d