Technical impact
Based on the description, it is inferred that an attacker must be able to transmit abusive HTTP/2 frames to the server in order to trigger the crash or resource exhaustion. The vulnerability allows such a client to cause Apache Traffic Server to crash or be driven to resource exhaustion. The abusive framing exploits the server's flow‑control handling and is classified as CWE‑400, leading to a denial of service. A single malicious client can trigger the crash, impacting availability for all connections served by the affected instance.
Affected Systems
Affected products are Apache Traffic Server from the Apache Software Foundation. Versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are vulnerable. All builds in those ranges are impacted, regardless of platform or configuration.
Risk and Exploitability
Based on the description, the likely attack vector is network-based via HTTP/2, inferred from the vulnerability being triggered by abusive framing; this indicates that any machine that can reach the server’s listening port can potentially exploit the flaw. The description also implies that no authentication is required, as the flaw is exploited simply by sending HTTP/2 frames. The CVSS score of 8.7 indicates a high severity, while the EPSS score of less than 1% suggests low but nonzero exploit probability. The vulnerability is not listed in the CISA KEV catalog.
