Apache Traffic Server incorrectly processes on‑disk cache entries and object lifetimes, leading to corrupted internal state or process termination. The flaw is a serialized data weakness (CWE‑502). An attacker delivering malformed cache data could cause a denial‑of‑service by exhausting resources or corrupting critical data structures, potentially harming the integrity of the server's operation.

Apache Software Foundation’s Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are affected.

The CVSS score of 8.3 indicates a high severity impact, while the EPSS score of less than 1% suggests low probability of exploitation within the next year. The flaw is not yet listed in CISA KEV. The vulnerability is most likely to be triggered by an external actor able to influence cache contents—such as a remote client sending crafted HTTP responses—or by a local user with permissions to write cache files. Exploitation would require the attacker to deliver a malicious cache entry that the server deserializes, leading to state corruption or a crash.