Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. The flaw occurs when the server reuses tunnel identifiers across distinct client streams without isolation, creating a confidentiality breach classified as CWE-200. If exploited, an attacker could read sensitive information intended for other clients, potentially revealing proprietary or personal data.

This vulnerability affects Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. The product is maintained by the Apache Software Foundation. Administrators deploying any of these releases should verify whether they are running the affected versions.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker who can inject or control traffic through multiple client connections, inferred from the description of normal session pooling. Successful exploitation would allow data destined for one client to be read by another client connected to the same proxy server, compromising confidentiality.