This vulnerability allows an attacker that can send HTTP/2 protocol frames to cause Apache Traffic Server to exhaust memory and crash. The abusive framing exploits the server's flow‑control handling and is classified as CWE‑400, leading to a denial of service. A single malicious client can trigger the crash, impacting availability for all connections served by the affected instance.

Affected products are Apache Traffic Server from the Apache Software Foundation. Versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are vulnerable. All builds in those ranges are impacted, regardless of platform or configuration.

The CVSS score of 8.7 indicates a high severity, while the EPSS score of less than 1% suggests low but nonzero exploit probability. The vulnerability is not listed in the CISA KEV catalog. The attack is carried out over the network via the HTTP/2 protocol, so any machine that can reach the server’s listening port can potentially exploit the flaw. No special conditions are required beyond normal client access, and the server can be brought down without authentication.