Apache Traffic Server EUVD-2026-107538

Exploitation requires that ATS be deployed as a forward/reverse proxy to an origin server that returns chunked transfer-encoded responses, and the attacker must tear down a client POST request via TCP half-close precisely while that chunked origin response is being reparsed from a reentrant write-ready callback. This is a timing-dependent race (reflected as CVSS AT:P), so it is not reliably triggered by a single request and typically needs repeated attempts. The condition is further scoped to builds carrying the CVE-2021-32564 flow-control backports that introduced the flow, limiting exposure to affected versions 9.2.15, 10.1.4, and 10.2.0. Impact is limited to a crash (denial of service) - no code execution, data disclosure, or integrity loss - and the race nature, not authentication (none required, PR:N), is the primary practical limiting factor.

This is a denial-of-service null pointer dereference (CWE-476) in Apache Traffic Server. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) with VA:H and VC:N/VI:N describes a network-reachable, unauthenticated availability-only impact (crash), which is consistent with the description of a server crash. The critical nuance is the AT:P metric (Attack Requirements: Present), which correctly reflects that this is a timing-dependent race condition - exploitation is not deterministic and depends on winning a narrow window where a client POST is half-closed while a chunked origin response is being reparsed from a reentrant write-ready callback. The 8.2 score is driven almost entirely by the unauthenticated network reachability and total availability loss, not by ease or reliability of exploitation. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation; the risk is currently theoretical/latent. In practical terms this is a 'patch on normal cadence' item for most operators rather than an emergency: it is a crash-only bug (no RCE, no data exposure), it requires a race condition rather than a single deterministic request, and it only manifests under a specific proxying flow. Conflicting-signal note: the CVSS vector claims AV:N/AC:L, but the description makes clear exploitation is a reentrant-callback timing race, which is why AT:P is set - treat 'low complexity' as misleading on its own without the AT:P qualifier.

A remote, unauthenticated attacker repeatedly sends POST requests to an ATS instance proxying to an origin that returns chunked responses, then abruptly half-closes each connection at the moment the origin response is being reparsed. By racing this teardown against the reentrant write-ready callback, the attacker eventually triggers a null pointer dereference that crashes the proxy, denying service to all users. No public exploit code is identified at time of analysis, and because it is a timing race (CVSS AT:P), reliable triggering requires repeated attempts rather than a single request.