CVE-2026-58162 affects the Apache Traffic Server certifier plugin, which generates TLS certificates based on attacker-controlled client Server Name Indication (SNI) values. This flaw allows an attacker to potentially manipulate certificate generation, posing a significant security risk. The vulnerability spans multiple major version branches: 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Apache has released patched versions 9.2.15 and 10.1.4 to address the issue. Users are strongly recommended to upgrade to these fixed versions immediately. The issue originates from insufficient validation of client-supplied SNI data within the certifier plugin.