Apache Traffic Server fails to properly handle integer values while decoding HPACK/XPACK headers, which can corrupt memory in the process. This flaw falls under CWE-190, an integer overflow or underflow vulnerability, and may allow an attacker to deliver crafted headers that abuse the decoding logic and modify data structures in memory. The corruption could potentially lead to unpredictable behavior, including crashes or privilege escalation, if the affected code paths are executed by a privileged user. The CVE description does not explicitly state that remote code execution is guaranteed, but the memory corruption creates the possibility of arbitrary code execution under the right conditions.

The vulnerability affects Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Users who run any of those releases are subject to the integer‑handling error during HPACK/XPACK decoding.

The CVSS score of 6.9 indicates a moderate severity, and the EPSS score of less than 1% signals a low but nonzero probability of exploitation at the time of analysis. Because the flaw is triggered by external traffic that decodes HTTP/2 headers, the attack vector is inferred to be remote and network – an attacker could send a malicious request to an exposed Traffic Server instance. Since the vulnerability is not listed in CISA’s KEV catalog, there is no confirmed widespread exploitation yet, but the combination of remote trigger, memory corruption potential, and a moderate CVSS assessment suggests that the risk level warrants timely remediation.