Apache Traffic Server 9.2.15, 10.1.4, and 10.2.0 generate an unthrottled diagnostic log line for each internal @ header stripped from a request. A request with many such headers therefore forces the proxy to write far more log data than the request size, causing excessive disk I/O and rapid consumption of log space, which can reach a point where the proxy can no longer process new traffic, effectively disabling the service.

The issue affects Apache Traffic Server releases 9.2.15, 10.1.4, and 10.2.0. Users operating those exact versions should be aware that any HTTP request containing a large number of @ headers can trigger log flooding and potentially a denial of service.

The vulnerability has a CVSS score of 8.7, classifying it as high severity. Exploitation requires the ability to send crafted HTTP traffic to the proxy, which is typically available to external attackers over open ports. The EPSS score of < 1% indicates a very low exploitation probability, and the issue is not listed in the CISA KEV catalog. The potential impact of a log-flood denial of service remains significant for environments with limited disk space or log rotation strategies. Administrators should consider this risk high when assessing exposure to untrusted clients.