Executive brief
Apache Traffic Server, a high-performance caching proxy used to manage web traffic, is vulnerable to a flaw that can cause the service to crash. By sending specifically crafted network traffic during the initial secure connection setup (TLS/SNI), an attacker can disrupt web services and cause a denial-of-service. This impact prevents legitimate users from accessing hosted content and may require manual intervention to restore operations.
Technical details
A denial-of-service vulnerability exists in Apache Traffic Server due to improper handling of TLS and Server Name Indication (SNI) requests. The flaw involves null pointer dereferences (CWE-476) and dangling references within the TLS handshake processing logic. A remote, unauthenticated attacker can exploit this by sending malformed TLS/SNI packets, leading to a process crash. The issue affects versions 8.x, 9.x, and 10.x, and has been addressed in versions 9.2.15 and 10.1.4.
Affected products
- Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, 10.0.0 through 10.1.3
Timeline
- 2026-07-29: advisory: Initial publication of CVE-2026-58161
- 2026-07-29: disclosed