Apache Traffic Server CVE-2026-58161

Exploitation requires only the ability to initiate a TLS/HTTPS handshake against an Apache Traffic Server instance that terminates TLS (i.e., an HTTPS listener with SNI processing enabled - the normal configuration for reverse-proxy/CDN edge use). The trigger is attacker-controlled SNI/TLS handshake data, which ATS parses before authentication, so no credentials, user interaction, or prior access are needed (PR:N/UI:N). Limiting factors: the instance must be reachable on its TLS port and must be running an affected version (8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3); instances that do not terminate TLS or are firewalled to trusted clients have materially reduced exposure. Impact is confined to a crash/denial of service - there is no confidentiality or integrity impact (C:N/I:N).

Signals are consistent and point to a genuine but availability-only concern. The CVSS 3.1 vector is network, low-complexity, no privileges, no user interaction with High availability impact and no confidentiality/integrity impact - meaning easy remote crashing but no data exposure or code execution. No EPSS score, KEV listing, or POC was provided, so exploitation is not confirmed active and no exploit code is known at time of analysis; the CWE-476 class and pre-auth SNI reachability make crash-triggering plausible but generally not weaponizable beyond DoS. SSVC-style reading: exploitation = none observed, automatable = likely yes (a repeatable malformed handshake can be scripted), technical impact = partial (availability only, no system takeover). This is a real patch-soon priority for internet-facing ATS deployments due to easy pre-auth DoS, but it is not a code-execution emergency. Note that versions 8.0.0-8.1.9 are listed as affected but no 8.x fix is offered (only 9.2.15 and 10.1.4), implying the 8.x branch is end-of-life - verify with Apache.

An attacker on the network opens a TLS connection to an internet-facing Apache Traffic Server instance and sends a crafted ClientHello with a malformed or specific SNI value that drives ATS into the vulnerable TLS/SNI code path, dereferencing a null or dangling pointer and crashing the process. Repeating the handshake keeps the proxy offline, denying service to all legitimate users behind it. No authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N), and no public exploit code has been identified at time of analysis.