Apache Traffic Server can crash from null dereference and dangling reference bugs in its TLS and SNI handling. The flaw manifests as a denial‑of‑service condition that renders the server unavailable. The underlying weakness is a memory‑safety error identified as CWE‑476.

The vulnerability affects Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. All impacted releases share the same TLS and SNI processing code that contains the fault.

The CVSS score of 9.2 indicates a critical risk level, yet the EPSS score is reported as <1%, suggesting a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. While no public exploit has been disclosed, the easiest attack vector would involve an attacker crafting TLS connections or SNI fields that trigger the null or dangling reference, leading to a server crash. This inference is based on the nature of the bug and typical attack patterns for memory‑safety errors.