CVE-2026-58161
Last modified
CVE-2026-58161 is a critical-severity vulnerability rated 9.2/10 on the CVSS scale. Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.. EPSS estimates a 0.44% chance of exploitation in the next 30 days.
Description
Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Traffic Server | >= 8.0.0, <= 8.1.9 |
| Apache | Traffic Server | >= 9.0.0, < 9.2.15 |
| Apache | Traffic Server | >= 10.0.0, < 10.1.4 |
References
- https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6dMailing List, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-58161?
How severe is CVE-2026-58161?
How do I fix CVE-2026-58161?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-58156Apache Traffic Server mis-parses ports in URLs and userinfo,…6.3
- CVE-2026-58157Apache Traffic Server can reuse server sessions and tunnels …8.7
- CVE-2026-58158Apache Traffic Server mishandles PROXY protocol input, trunc…8.2
- CVE-2026-58159Apache Traffic Server can bypass IP access controls on UDS l…8.2
- CVE-2026-5816GitLab has remediated an issue in GitLab CE/EE affecting all…8.1
- CVE-2026-58160Apache Traffic Server reads out of bounds while parsing DNS …6.5
- CVE-2026-58162The Apache Traffic Server certifier plugin generates certifi…10
- CVE-2026-58163Apache Traffic Server mishandles on-disk cache fields and ob…9.1
- CVE-2026-58164Apache Traffic Server has use-after-free and time-of-check/t…8.3
- CVE-2026-58165OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a …8.8
- CVE-2026-58166OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, cont…9.1
- CVE-2026-58167Nightingale (n9e) before 9.0.0-beta.2 exposes full datasourc…7.1
Are you affected by CVE-2026-58161?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST