Apache Traffic Server has a flaw that causes a chunked transfer to stall when the server drops trailer headers (proxy.config.http.drop_chunked_trailers). Because the server expects to receive the dropped trailer bytes, it waits until the connection times out, effectively blocking the passthrough stream. The flaw can lead to a denial of service for any client relying on that transfer, as the server cannot forward the remaining data until the timeout.

The vulnerability affects Apache Traffic Server version 8.1.11; all releases 9.2.5 through 9.2.15; 10.0.0 through 10.1.4; and 10.2.0. In the 10.x family, the drop chunked trailers setting is enabled by default, while in 8.1.11 and 9.2.x it is disabled by default but the system remains vulnerable if the option is manually enabled.

With a CVSS score of 6.9 the flaw is considered moderate severity. The EPSS score of <1% indicates a very low exploitation probability, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector would require an attacker to be able to send a chunked HTTP request that includes trailer headers. The attacker could force clients to send such a request, causing the server to stall and tying up resources until timeouts occur. No privileged access or extensive preparation is required.