CVE-2026-58161: Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server
Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.15 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58161?
CVE-2026-58161 has a severity rating of 9.2, classified as critical.
What causes CVE-2026-58161?
CVE-2026-58161 is caused by memory-safety errors in TLS and SNI handling, leading to server crashes.
How do I fix CVE-2026-58161?
To fix CVE-2026-58161, upgrade to Apache Traffic Server version 9.2.15 or 10.1.4.
Which versions of Apache Traffic Server are affected by CVE-2026-58161?
CVE-2026-58161 affects Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.
What impact does CVE-2026-58161 have on my server?
CVE-2026-58161 can lead to the crashing of the server due to null dereferences and dangling references.