Apache Traffic Server can improperly reuse server sessions, potentially exposing data between client connections. The flaw arises when the server reuses tunnel identifiers across distinct client streams without isolation, creating a confidentiality breach classified as CWE-200. If exploited, an attacker could read sensitive information that was meant for other clients, potentially revealing proprietary or personal data.

This vulnerability affects Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. The product is maintained by the Apache Software Foundation. Administrators deploying any of these releases should verify whether they are running the affected versions.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog, implying it has not yet been widely abused. The likely attack vector is an attacker who can inject or control traffic through multiple client connections, inferred from the description of normal session pooling. Successful exploitation would allow data destined for one client to be read by another client connected to the same proxy server, compromising confidentiality.