Apache Traffic Server incorrectly reuses multiplexed HTTP/2 connections to upstream origin servers without re‑verifying the server certificate against the new request hostname. This flaw is a certificate validation weakness (CWE‑295) that can lead to confidentiality or integrity compromises if an attacker gains control of one origin hostname and forces the server to use the same TLS session for a different hostname whose certificate does not cover it. Consequently, data intended for a legitimate origin could be exposed or altered, and authentication mechanisms based on TLS validation could be circumvented.

The vulnerability is present in Apache Traffic Server versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3. Upgrading to 9.2.15 or 10.1.4 removes the flaw.

The CVSS score of 6.3 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation at this time, and the flaw is not currently listed in CISA's KEV catalog. Exploitation would likely require the attacker to prompt the ATS to initiate origin requests to a target hostname that it did not originally verify, meaning the attacker needs some influence over the traffic patterns or control over the origin host. The attack vector is inferred to be remote, with an attacker manipulating client requests or the origin environment to trigger the reuse of a session for a different hostname. Given the limited exploitation probability, the risk remains moderate, but prompt remediation is advised to eliminate the potential for data leakage or authentication bypass.