What’s Vulnerable › Vulnerabilities

CVE-2021-38161: Not validating origin TLS certificate

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-11-03 · updated 2026-06-17
• Weakness: CWE-287

Description

Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks. This issue affects Apache Traffic Server 8.0.0 to 8.0.8.

Affected products

• Apache Software Foundation Apache Traffic Server: from 8.0.0 through 8.0.8
• Debian Linux: 10.0, 11.0

References

• https://lists.apache.org/thread/k01797hyncx53659wr3o72s5cvkc3164
• https://www.debian.org/security/2022/dsa-5153
• https://lists.apache.org/thread/k01797hyncx53659wr3o72s5cvkc3164
• https://www.debian.org/security/2022/dsa-5153

Get alerted when CVE-2021-38161 or the next vulnerability affects your stack