7.5High
CVE-2026-58161Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server
Description
Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Weakness (CWE):
CWE-476
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Apache Software Foundation | Apache Traffic Server | 8.0.0 – ≤ 8.1.11, 9.0.0 – ≤ 9.2.14, 10.0.0 – ≤ 10.1.3 | |
| apache | traffic server | 8.0.0 – ≤ 8.1.9 |
References and patches
- https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d vendor-advisoryMailing ListVendor Advisory
CPE matches (NVD) (3)
cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*≥ 8.0.0 ≤ 8.1.9cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*≥ 9.0.0 < 9.2.15cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*≥ 10.0.0 < 10.1.4