Skip to main content

Apache Traffic Server CVE-2026-58161

| EUVDEUVD-2026-50217 CRITICAL
NULL Pointer Dereference (CWE-476)
2026-07-29 apache GHSA-29wv-p4qw-p36r
Null Pointer Dereference Denial Of Service Apache Apache Traffic Server
9.2
CVSS 4.0 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
9.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Pre-auth attacker-controlled SNI over the network (AV:N/AC:L/PR:N/UI:N) crashes the process for availability-only impact (A:H, C:N/I:N), no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Severity Changed
Jul 29, 2026 - 10:22 NVD
HIGH CRITICAL
CVSS changed
Jul 29, 2026 - 10:22 NVD
7.5 (HIGH) 9.2 (CRITICAL)
Analysis Generated
Jul 29, 2026 - 09:52 vuln.today
CVE Published
Jul 29, 2026 - 08:35 cve.org
HIGH 7.5

DescriptionCVE.org

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Articles & Coverage 1

News Critical DoS via NULL Pointer Dereference in Apache Traffic Server - CVE-2026-58161 Jul 30, 2026

AnalysisAI

Remote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated attackers to crash the proxy by triggering NULL pointer dereferences and dangling references during TLS and SNI processing. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H) reflects a network-reachable, low-complexity availability impact with no confidentiality or integrity loss. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach TLS listener over network
Delivery
Send crafted ClientHello with malicious SNI
Exploit
Trigger null/dangling dereference in TLS handling
Execution
Crash Traffic Server process
Persist
Repeat handshake to sustain outage
Impact
Denial of service to proxied clients
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires only the ability to initiate a TLS/HTTPS handshake against an Apache Traffic Server instance that terminates TLS (i.e., an HTTPS listener with SNI processing enabled - the normal configuration for reverse-proxy/CDN edge use). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Signals are consistent and point to a genuine but availability-only concern. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker on the network opens a TLS connection to an internet-facing Apache Traffic Server instance and sends a crafted ClientHello with a malformed or specific SNI value that drives ATS into the vulnerable TLS/SNI code path, dereferencing a null or dangling pointer and crashing the process. Repeating the handshake keeps the proxy offline, denying service to all legitimate users behind it. …
Remediation Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 9.x branch) or 10.1.4 (for the 10.x branch) as the primary and complete fix. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Apache Traffic Server deployments to identify instances running versions 8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Apache Traffic Server

View all
CVE-2026-58154 CRITICAL
9.2 Jul 29

Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
CVE-2026-58155 CRITICAL
9.2 Jul 29

Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
CVE-2026-58151 HIGH
8.7 Jul 29

Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
CVE-2026-58188 HIGH
8.4 Jul 29

Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
CVE-2026-58162 HIGH
8.4 Jul 29

Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
CVE-2026-58164 HIGH
8.3 Jul 29

Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
CVE-2026-58163 HIGH
8.3 Jul 29

Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
CVE-2026-58184 HIGH
8.3 Jul 29

Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy
CVE-2026-58177 HIGH
8.3 Jul 29

Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows rem
CVE-2026-58180 HIGH
8.2 Jul 29

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-b
CVE-2026-58178 HIGH
8.2 Jul 29

Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers t
CVE-2026-58175 HIGH
8.2 Jul 29

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a memory

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Null Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Share

CVE-2026-58161 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy