Apache Traffic Server leaks memory when handling HostDB SRV records. Based on the description, it is inferred that repeated handling of such records can gradually allocate memory without freeing it, potentially exhausting server resources and causing a denial of service. The weakness is captured by CWE-401, indicating improper disposal of resources.

Apache Traffic Server components from versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are affected. Official patches are available in releases 9.2.15 and 10.1.4, which eliminate the leak.

The CVSS base score of 8.2 labels this vulnerability as high severity, while the EPSS score of less than 1 % suggests a very low likelihood of exploitation at the time of analysis. It is not listed in CISA’s KEV catalog. Although the precise attack vector is not detailed in the advisory, the flaw involves processing SRV records. The likely attack vector is a remote host sending crafted SRV queries to trigger the leak, which is inferred from the description that the server processes SRV records. There is no publicly available workaround beyond upgrading, so mitigation must rely on the vendor’s patch.