Apache Traffic Server versions 9.2.15, 10.1.4, and 10.2.0 write an unthrottled diagnostic log entry for every internal @ header removed from a request. If an attacker sends a request with many @ headers, the proxy can generate a log output that far exceeds the size of the original request, leading to excessive disk I/O, rapid consumption of log space, and a denial of service that can disrupt normal proxy operation.

The problem affects Apache Traffic Server releases 9.2.15, 10.1.4, and 10.2.0. Users running those exact versions should be aware that any request containing a large number of @ headers can trigger the issue. Versions 9.2.16, 10.1.5, and 10.2.1 incorporate the fix and are not susceptible.

The vulnerability has a CVSS score of 8.7, classifying it as high severity. Exploitation requires an ability to send crafted HTTP traffic to the proxy, which is usually available to external attackers over open ports. Because EPSS data is not available and the issue is not listed in CISA's KEV catalog, the probability of widespread exploitation remains uncertain but the potential impact of a log-flood DoS is significant for environments with limited disk space or log rotation. Administrators should consider this risk high when assessing exposure to untrusted clients.