Apache Traffic Server EUVD-2026-50210

Exploitation requires that ATS be configured to reuse/share persistent origin server sessions and tunnels across client connections (its performance-oriented keep-alive/session-pooling behavior) and that the proxy be concurrently serving multiple clients whose data can cross over. No authentication is required (PR:N) and the attacker needs only network reachability to the proxy. Limiting factors: the flaw is not deterministic - high attack complexity (AC:H) means the attacker cannot reliably force which client's data is exposed and depends on concurrent-connection timing; environments that disable session sharing/pooling or dedicate sessions per client are not exposed. Affected only in versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3.

The signals are moderately-to-highly concerning but not maximal. CVSS is 8.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N): remotely reachable and unauthenticated (PR:N) with critical confidentiality impact and a scope change, but tempered by high attack complexity (AC:H) because triggering the improper reuse depends on session-pool timing and concurrent-connection conditions the attacker does not fully control. No EPSS score, POC, or KEV entry was provided, so there is no evidence of active exploitation or automation - this is currently a high-severity-by-CVSS issue rather than a confirmed in-the-wild threat. Note a discrepancy worth flagging: the vendor vector asserts I:H (integrity), but the description characterizes the defect as data exposure across connections, which is primarily a confidentiality problem; integrity impact (e.g., request/response mis-association) is plausible but not clearly established in the text - verify with the Apache advisory before treating integrity loss as confirmed.

An attacker sends normal HTTP(S) requests through an ATS proxy that simultaneously serves many other clients; by driving concurrent connections and exploiting the flawed session/tunnel reuse, the attacker occasionally receives a response (or tunnel data) intended for a different client, harvesting another user's sensitive content such as authenticated pages or tokens. Because exploitation depends on session-pool timing (CVSS AC:H) and no POC is published, an attacker would likely need repeated attempts and favorable load conditions rather than a single deterministic request.