Apache Traffic Server has a flaw that accepts HTTP request headers beginning with the '@' character without sanitizing them. This improper input validation could allow an attacker to insert internal metadata that the server normally trusts only from internal sources. The vulnerability is classified as CWE‑20, and the CVE description does not explicitly state the exact consequences that could result from such metadata spoofing.

Apache Traffic Server versions 9.2.0 through 9.2.14 and 10.1.0 through 10.1.3 are vulnerable. Users should verify the exact version in use and upgrade to the fixed releases 9.2.15 or 10.1.4.

The CVSS score of 7.7 reflects moderate‑to‑high severity. The EPSS score of less than 1% suggests a low probability of active exploitation at present. The flaw can be triggered by HTTP requests that contain malicious '@' headers; this attack vector is inferred from the nature of the input validation weakness and is not explicitly stated in the CVE. The vulnerability is not listed in the CISA KEV catalog, indicating no known public exploitation.