Apache Traffic Server mishandles integer values when decoding HPACK/XPACK headers, which can corrupt the process memory. The vulnerability is an integer handling error categorized as CWE-190. The flaw does not explicitly state that arbitrary code can be executed, but the corrupted memory can lead to incorrect program state while handling HTTP/2 header data.

The issue affects all Apache Traffic Server releases from 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3, all distributed by the Apache Software Foundation. The vendor recommends upgrading to 9.2.15 or 10.1.4 to eliminate the flaw.

The CVSS score of 6.9 indicates a moderate severity level. The EPSS score of less than 1% shows a low but non‑zero likelihood that attackers could successfully exploit the flaw. The vulnerability is not listed in the CISA KEV catalog, suggesting no widely documented exploitation as of now. The likely attack vector is external network traffic, specifically malicious HTTP/2 requests that contain crafted HPACK/XPACK headers, and the impact is confined to the Traffic Server instance that processes such traffic.