Which versions of Apache Traffic Server are affected by CVE-2026-58161?

Apache Traffic Server versions 8.0.0 through 10.1.3 are vulnerable to unauthenticated remote denial-of-service attacks that can crash proxy infrastructure through TLS/SNI processing flaws.

How to fix or mitigate CVE-2026-58161?

Within 24 hours, inventory all Apache Traffic Server deployments to identify instances running versions 8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3. Within 7 days, deploy vendor patches by upgrading to Apache Traffic Server 9.2.15 (for the 9.x branch) or 10.1.4 (for the 10.x branch), or upgrade to a newer stable release if 8.x support has ended. Within 30 days, verify patch application across all instances through version verification and deployment logs, and implement enhanced monitoring to detect abnormal proxy crash patterns or TLS/SNI processing anomalies.

Apache Traffic Server CVE-2026-58161

Q: What is the CVSS score of CVE-2026-58161?

CVE-2026-58161 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-50217 CRITICAL

NULL Pointer Dereference (CWE-476)

2026-07-29 apache

GHSA-29wv-p4qw-p36r

Denial Of Service Apache Null Pointer Dereference Apache Traffic Server Apache Software Foundation

9.2

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

9.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Pre-auth attacker-controlled SNI over the network (AV:N/AC:L/PR:N/UI:N) crashes the process for availability-only impact (A:H, C:N/I:N), no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 29, 2026 - 10:22 NVD

HIGH CRITICAL

CVSS changed

Jul 29, 2026 - 10:22 NVD

7.5 (HIGH) 9.2 (CRITICAL)

Analysis Generated

Jul 29, 2026 - 09:52 vuln.today

CVE Published

Jul 29, 2026 - 08:35 cve.org

HIGH 7.5

DescriptionCVE.org

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Articles & Coverage 1

News Critical DoS via NULL Pointer Dereference in Apache Traffic Server - CVE-2026-58161 Jul 30, 2026

AnalysisAI

Remote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated attackers to crash the proxy by triggering NULL pointer dereferences and dangling references during TLS and SNI processing. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H) reflects a network-reachable, low-complexity availability impact with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is Apache-reported and patched in 9.2.15 and 10.1.4.

Technical ContextAI

Apache Traffic Server (ATS) is a high-performance forward and reverse caching HTTP/HTTPS proxy widely used as an edge and CDN layer. The vulnerability lives in its TLS termination and Server Name Indication (SNI) handling code, where the server inspects the client-supplied SNI value during the TLS handshake to select the appropriate certificate/routing context. The root cause is CWE-476 (NULL Pointer Dereference), compounded by use of dangling references - pointers to objects whose lifetime has ended. When ATS processes certain TLS/SNI conditions, code paths dereference a pointer that is null or references freed/out-of-scope state, causing the process to crash. Because SNI is parsed before authentication and is fully attacker-controlled, the parsing logic is reachable by any client that can open a TLS connection.

RemediationAI

Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 9.x branch) or 10.1.4 (for the 10.x branch) as the primary and complete fix. Deployments still on the 8.0.0-8.1.9 branch should migrate to a supported 9.2.15+ or 10.1.4+ release since no 8.x fix is offered. If immediate patching is not possible, reduce exposure by restricting who can reach the TLS listener - place ATS behind an upstream TLS terminator or load balancer that validates/normalizes SNI before traffic reaches ATS, or firewall the HTTPS port to trusted client ranges (trade-off: breaks open/public proxy use cases and CDN edge reachability). Monitor for repeated process crashes/restarts and enable automatic process supervision (traffic_manager/systemd restart) to limit outage duration as a stopgap only. Full details are in the Apache advisory: https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d.