The vulnerability allows a malformed 302 redirect with a Transfer‑Encoding: chunked carve‑out to bypass the HTTP parsing error handling in Apache Traffic Server. This causes the proxy to accept and cache the response as if it were valid, leading to cache poisoning and response‑framing desynchronization. The flaw is described by CWE‑444 and can lead to an attacker delivering arbitrary content or manipulating the framing of HTTP responses to downstream clients.

Affected products are Apache Traffic Server from the Apache Software Foundation. Versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 are vulnerable. Upgrading to version 9.2.16, 10.1.5, or 10.2.1 resolves the issue.

With a CVSS score of 9.2 the vulnerability is considered critical. Although EPSS information is not available, the lack of protection and the nature of cache poisoning suggest a non‑negligible risk of exploitation. The flaw is not listed in the CISA KEV catalog yet. An attacker can craft a malicious 302 response to a downstream peer that is accepted by the proxy, causing it to store and return poisoned content to client requests. The attack can be carried out remotely and benefits from the absence of parsing restrictions for the specific Transfer‑Encoding carve‑out.