Apache Traffic Server can crash due to a null pointer dereference in the net_write_io routine when a client POST request is closed via half‑close while a chunked origin response is being repacked from a re‑entrant write‑ready callback. The vulnerability is a timing‑dependent race condition introduced by the CVE‑2021‑32564 flow‑control backport. The flaw causes a server crash, which results in a denial of service. The weakness is classified as CWE‑476.

Apache Software Foundation’s Apache Traffic Server products are affected. The vulnerable releases are 9.2.15, 10.1.4, and 10.2.0.

The severity of the issue is high, with a CVSS score of 8.2. The EPSS score is not available, so the exact exploitation probability is unknown, but the lack of a K I V listing suggests no widespread exploit activity has been reported yet. The attack vector can be inferred to involve a malicious client that initiates a POST request and performs a half‑close while the server is processing a chunked response, triggering the race condition and causing the crash. Successful exploitation results in a denial of service to the service’s clients.