The vulnerability in Apache Traffic Server arises from a failure to enforce the policy that ensures the SNI field in the TLS handshake matches the HTTP Host header. Because of this, an attacker can construct a request with a mismatched SNI and Host header, causing the server to route the request to an unintended upstream host; this mis‑routing is an improper access control flaw (CWE‑284) and also a configuration‑based access control error (CWE‑1288).

Affected releases are Apache Traffic Server from the Apache Software Foundation, versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3. All 9.2.x releases before 9.2.15 remain vulnerable. The vendor recommends upgrading to 9.2.15 or 10.1.4, which contain the fix.

The CVSS score of 7 indicates a high severity. The EPSS score is <1%, indicating a very low probability of exploitation, and the absence of a KEV listing suggests the vulnerability is not currently being actively exploited in the wild, though it could be leveraged by an attacker. The flaw also constitutes a configuration‑based access control issue (CWE‑1288), which extends the potential for unintended upstream routing. Based on the vulnerability type, it is inferred that no special privileges are required. The likely attack vector is a remote HTTP(S) request to the server with intentionally mismatched SNI and Host header values (inferred). Organizations running the affected versions should consider the risk level when planning remediation.