VulnSocial

CVE-2026-58161Disclosure(apache / traffic_server)

LOWCVSS 9.2 · CRITICAL

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

apache CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-476

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • traffic_server

Threat summary

  • Public PoC is present in monitored signal
  • 2 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
apache
Products
traffic_server

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-29: 2PoC Mentioned / Linked · 2026-07-29: 1Technical Details · 2026-07-29: 207-29
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets3 URLs
Full discourse2 posts
  • Aretiq.AI@AretiqAI
    Disclosure

    ARETIQ Daily Vulnerability Bulletin — July 29, 2026 🔴 CRITICAL: CVE-2026-54735 (prebid/prebid-server) AAS 12.3 🔴 CRITICAL: CVE-2026-58161 (apache_software_foundation/apache_traffic_server) AAS 12.2 — PoC available 🔴 CRITICAL: CVE-2026-63227 (an_unrestricted_scorm_file_upload_vulnerability_in_koollab_lms_allowed_an_authenticated_module_designer_to_upload_a_scorm_package_containing_a_php_webshell_to_a_publicly_accessible_directory_and_execute_arbitrary_code_on_the_server./koollab_lms) AAS 12.1 28 vulnerabilities — CRITICAL: 3, HIGH: 25 Full bulletin: https://aretiq.ai/bulletins/2026-07-29/

    Post summary

    The bulletin announces three critical CVEs, noting that one has a proof‑of‑concept available, but provides limited detail regarding exploitation or mitigation.

    00040195
    232 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-58161 Denial of Service via Null Dereference in Apache Traffic Server T... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-58161 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1

    Post summary

    The post announces CVE-2026-58161, a denial‑of‑service via null dereference in Apache Traffic Server, but offers no PoC, exploit, or mitigation details.

    0000080
    4.1K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapachetraffic_server---

Explore more

Back to dashboardapache CVEstraffic_server vulnerabilities