A high-severity session management flaw in Apache Traffic Server may result in sensitive data leakage between client connections, necessitating immediate attention.

The software exhibits improper handling of server sessions and tunnels (CWE-200), which allows data from one session to potentially persist or leak into another. This vulnerability is exploitable by an unauthenticated remote attacker.

The leakage of sensitive information across client connections can lead to severe breaches of confidentiality and regulatory compliance failures. With a CVSS score of 8.7, this vulnerability presents a critical threat to the integrity of communication streams handled by the proxy server.

Immediate Action: Update Apache Traffic Server to the latest version as specified by the Apache Software Foundation security bulletin.

Proactive Monitoring: Review traffic logs for anomalies in session handling or unexpected data patterns that might indicate cross-session information leakage.

Compensating Controls: While no direct WAF rule can fix session logic, ensure that backend services are configured to use short-lived sessions to minimize the window of exposure.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of the vulnerability, administrators must treat this as a priority update. Apply the latest patches provided by the Apache Software Foundation to prevent potential unauthorized access to sensitive data streams.