CVE-2026-58161: Apache Traffic Server DoS Vulnerability

CVE-2026-58161 Overview

CVE-2026-58161 is a null pointer dereference vulnerability in Apache Traffic Server that causes the proxy to crash when handling Transport Layer Security (TLS) and Server Name Indication (SNI) traffic. The flaw stems from dangling references and null dereferences [CWE-476] in the TLS and SNI processing paths. Remote, unauthenticated attackers can trigger the crash over the network by sending crafted TLS traffic. The vulnerability affects Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Upstream fixes ship in versions 9.2.15 and 10.1.4.

Critical Impact
Unauthenticated network attackers can crash Apache Traffic Server proxies handling TLS/SNI traffic, disrupting availability of any service fronted by the affected caching proxy.

Affected Products

Apache Traffic Server 8.0.0 through 8.1.9
Apache Traffic Server 9.0.0 through 9.2.14
Apache Traffic Server 10.0.0 through 10.1.3

Discovery Timeline

2026-07-29 - CVE-2026-58161 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-58161

Vulnerability Analysis

Apache Traffic Server is a high-performance HTTP caching proxy widely deployed as an edge and reverse proxy. The vulnerability resides in the code paths that process TLS handshakes and SNI extensions. Under specific conditions, the proxy dereferences a null pointer or accesses a dangling reference tied to TLS session state or SNI context. The resulting crash terminates the worker process and disrupts proxied traffic. The issue is reachable pre-authentication over any TLS listener exposed by the proxy, which typically includes production internet-facing interfaces.

Root Cause

The root cause is improper lifetime and null-state management of objects used during TLS negotiation and SNI callback handling. The affected code fails to validate that referenced objects remain valid before dereferencing them, matching the pattern described by CWE-476: NULL Pointer Dereference. Dangling references indicate that objects are freed or reassigned while other code paths still hold pointers to them.

Attack Vector

An attacker sends crafted TLS ClientHello messages, including specific SNI values or handshake sequences, to a listener served by Apache Traffic Server. No credentials, user interaction, or prior access are required. Successful exploitation causes the server process to crash, producing a denial-of-service condition against every backend service reachable through the proxy. Repeated attempts prevent recovery and can be scripted from a single low-cost source.

See the Apache Mailing List Discussion for upstream technical details.

Detection Methods for CVE-2026-58161

Indicators of Compromise

Unexpected traffic_server process crashes or restarts recorded by the operating system service manager or systemd journal.
Segmentation faults or core dumps generated by the Apache Traffic Server binary during TLS handshakes.
Spikes in TLS handshake failures or connection resets from the proxy's client-facing listeners.
Repeated ClientHello traffic from a small set of source IPs preceding proxy outages.

Detection Strategies

Monitor Apache Traffic Server logs (diags.log, error.log) for handshake errors and abnormal termination messages.
Alert on process restart counts for traffic_server exceeding a low baseline within short windows.
Correlate TLS handshake failure rates with source IP concentration to surface targeted probing.
Compare deployed Apache Traffic Server versions against the fixed releases 9.2.15 and 10.1.4 during vulnerability scans.

Monitoring Recommendations

Ingest proxy process telemetry, core dump events, and TLS metrics into a centralized analytics platform for correlation.
Track upstream availability metrics; sudden drops localized to a single proxy fleet suggest a crash-based DoS.
Enable and retain core dumps in a controlled path so incident responders can confirm the crash signature.

How to Mitigate CVE-2026-58161

Immediate Actions Required

Upgrade Apache Traffic Server to version 9.2.15 (for 9.x deployments) or 10.1.4 (for 10.x deployments) as soon as change control permits.
Retire Apache Traffic Server 8.x instances, which remain affected and have no fixed release listed in the advisory.
Restrict exposure of proxy management and TLS listeners to trusted network ranges where feasible.
Ensure process supervisors automatically restart traffic_server to limit outage duration while patching is scheduled.

Patch Information

The Apache Traffic Server project fixed the null dereference and dangling reference conditions in versions 9.2.15 and 10.1.4. Users on the 8.x branch should migrate to a supported, patched release. Reference: Apache Mailing List Discussion.

Workarounds

Place an upstream load balancer or Web Application Firewall (WAF) capable of TLS termination in front of Apache Traffic Server to absorb malformed handshakes.
Rate-limit new TLS connections per source IP at the network edge to reduce crash amplification.
Restrict which SNI hostnames the proxy will accept, where configuration allows, to narrow the reachable code paths.
Deploy redundant proxy instances behind a health-checked balancer so a crash on one node does not remove capacity for the service.

bash

# Verify the running Apache Traffic Server version
traffic_server -V

# Example upgrade path on a Debian/Ubuntu system after adding a patched package source
sudo systemctl stop trafficserver
sudo apt-get update && sudo apt-get install --only-upgrade trafficserver
traffic_server -V   # confirm 9.2.15 or 10.1.4
sudo systemctl start trafficserver
sudo systemctl status trafficserver