CRITICAL 9.2 NVD
CVE-2026-58161
Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 th
Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Affected Products
- apache/traffic_server
References
This critical severity vulnerability with a CVSS score of 9.2 was published on 2026-07-29 via NVD. Affected: apache/traffic_server.
Risk Timeline
CVE Disclosed2026-07-29 · 5 days ago
Remediation Resources
Analysis & PoC
lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6dRelated Vulnerabilities
| CVE | Title | Severity | CVSS |
|---|---|---|---|
| CVE-2026-58154 | Apache Traffic Server can write out of bounds or overflow integers while parsing | CRITICAL | 9.2 |
| CVE-2026-58155 | Apache Traffic Server truncates over-long header names, allowing header aliasing | CRITICAL | 9.2 |
| CVE-2026-58179 | The Apache Traffic Server regex_remap plugin overflows the stack and integers fr | CRITICAL | 9.2 |
| CVE-2026-58151 | Apache Traffic Server can be crashed or driven to resource exhaustion by abusive | HIGH | 8.7 |
| CVE-2026-58162 | The Apache Traffic Server certifier plugin generates certificates based on attac | HIGH | 8.4 |
| CVE-2026-58188 | Several Apache Traffic Server experimental plugins have memory-safety and limit- | HIGH | 8.4 |
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.