Apache Traffic Server mishandles the deserialization of on‑disk cache entries and the management of object lifetimes, leading to corruption of internal data structures or process termination. The flaw is a serialized data weakness (CWE‑502). Delivering malformed cache data could allow an attacker to trigger a denial‑of‑service through state corruption or crash the server. The updated description confirms that the improper handling of cache fields and lifetimes is the root cause of the vulnerability.

Apache Software Foundation’s Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are affected.

The CVSS score of 8.3 indicates a high severity impact, while the EPSS score of less than 1% suggests low probability of exploitation within the next year. The flaw is not yet listed in CISA KEV. The vulnerability is most likely to be triggered by an external actor able to influence cache contents—such as a remote client sending crafted HTTP responses—or by a local user with permissions to write cache files. Exploitation would require the attacker to deliver a malicious cache entry that the server deserializes, leading to state corruption or a crash.