Apache Traffic Server mis‑parses ports in URLs and userinfo, enabling a port‑based access‑control bypass. An attacker can craft specially formatted URLs that cause the server to incorrectly evaluate the target port, thereby evading ACL checks that were intended to restrict access. This flaw can lead to unauthorized disclosure or manipulation of protected resources and is categorized as a CWE‑863 weakness.

The flaw affects Apache Traffic Server released by the Apache Software Foundation. Versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are impacted. The issue is resolved in version 9.2.15 and later, and in version 10.1.4 and later.

The CVSS score of 6.3 indicates moderate severity. An EPSS score of less than 1% signifies a low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, as the flaw is triggered by requests sent to the Traffic Server. An attacker who can reach the proxy may use crafted URLs to circumvent ACL restrictions and gain access to otherwise protected resources.