Skip to main content

Apache Traffic Server EUVDEUVD-2026-50218

| CVE-2026-58162 HIGH
Improper Certificate Validation (CWE-295)
2026-07-29 apache GHSA-2w9p-8x38-7x8f
Apache Information Disclosure Apache Traffic Server
8.4
CVSS 4.0 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
8.4 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.7 HIGH

Network-reachable and unauthenticated (AV:N/PR:N), but AC:H reflects the required non-default certifier plugin; impact is integrity/availability high with low confidentiality, matching a cert-generation flaw.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

7
Analysis Updated
Jul 29, 2026 - 10:49 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 29, 2026 - 10:49 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 29, 2026 - 10:22 vuln.today
cvss_changed
Severity Changed
Jul 29, 2026 - 10:22 NVD
MEDIUM HIGH
CVSS changed
Jul 29, 2026 - 10:22 NVD
10.0 (MEDIUM) 8.4 (HIGH)
Analysis Generated
Jul 29, 2026 - 09:59 vuln.today
CVE Published
Jul 29, 2026 - 08:36 cve.org
MEDIUM 10.0

DescriptionCVE.org

The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

AnalysisAI

Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents of dynamically minted TLS certificates by controlling the client SNI value, affecting ATS 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3. Because the plugin trusts attacker-supplied SNI to drive certificate creation (CWE-295), an unauthenticated remote party can influence which identities the proxy vouches for, undermining TLS trust. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach ATS TLS listener over network
Delivery
Send ClientHello with crafted SNI
Exploit
Certifier plugin generates cert from SNI
Execution
Attacker obtains attacker-defined signed certificate
Impact
Abuse forged cert identity/trust
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the target Apache Traffic Server to have the certifier plugin loaded and enabled for dynamic certificate generation - this is the AT:P precondition and is not ATS's default configuration. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H) scores 8.4 and signals network-reachable, low-complexity, unauthenticated exploitation with high integrity and availability impact but only low confidentiality impact - consistent with a certificate-integrity flaw rather than data theft. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker connects to an ATS instance running the certifier plugin and presents a crafted SNI value in the TLS ClientHello, causing the plugin to generate and sign a certificate bearing an identity the attacker chose. The attacker leverages that attacker-influenced certificate to misrepresent trust or disrupt certificate handling on the proxy. …
Remediation Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 or 10.1.4, which fix the issue per the Apache advisory (https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d); note the 8.x line has no listed fixed release, so 8.0.0-8.1.9 users should migrate to a fixed 9.2.x or 10.1.x build. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all systems running Apache Traffic Server and identify which versions are deployed; prioritize production proxies handling sensitive traffic. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Apache Traffic Server

View all
CVE-2026-58161 CRITICAL
9.2 Jul 29

Remote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
CVE-2026-58154 CRITICAL
9.2 Jul 29

Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
CVE-2026-58155 CRITICAL
9.2 Jul 29

Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
CVE-2026-58151 HIGH
8.7 Jul 29

Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
CVE-2026-58188 HIGH
8.4 Jul 29

Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
CVE-2026-58164 HIGH
8.3 Jul 29

Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
CVE-2026-58163 HIGH
8.3 Jul 29

Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
CVE-2026-58184 HIGH
8.3 Jul 29

Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy
CVE-2026-58177 HIGH
8.3 Jul 29

Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows rem
CVE-2026-58180 HIGH
8.2 Jul 29

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-b
CVE-2026-58178 HIGH
8.2 Jul 29

Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers t
CVE-2026-58175 HIGH
8.2 Jul 29

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a memory

Same weakness CWE-295 – Improper Certificate Validation

View all
CVE-2015-3152 MEDIUM POC
5.9
CVE-2017-2800 CRITICAL POC
9.8
CVE-2014-1266 HIGH POC
7.4
CVE-2022-47758 CRITICAL POC
9.8
CVE-2025-68121 CRITICAL POC
10.0
CVE-2025-29331 CRITICAL POC
9.8
CVE-2025-32878 CRITICAL POC
9.8
CVE-2024-3738 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2023-4966 HIGH POC
7.5

Share

EUVD-2026-50218 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy