A malformed HTTP/2 request that truncates the Content‑Length header can cause Apache Traffic Server to consume worker threads until they are all allocated, halting backend processing. This flaw is identified as CWE‑400, a failure to properly validate input size related to resource exhaustion. The primary consequence is a denial of service on the originating HTTP/1.1 backend server, potentially impacting availability for all connected clients.

The vulnerability exists in Apache Traffic Server from version 8.0.0 through 10.2.0, including all releases 8.0.x through 8.1.11, 9.0.x through 9.2.15, 10.0.x through 10.1.4, and 10.2.0 itself. The fix is included in Apache Traffic Server 9.2.16, 10.1.5, and 10.2.1, and later releases inherit the patch.

With a CVSS score of 7.7 the flaw carries a high severity rating. The EPSS score is not available, and the vulnerability is not listed in KEV, indicating it has not yet been widely exploited but still poses a significant risk. The attack vector requires a network client capable of issuing HTTP/2 requests with a truncated Content‑Length value; the server will then allocate worker pool resources until saturation, causing backend denial of service. The exploitation demands no privileged access, making it relatively straightforward for an attacker to initiate the attack from outside the network.