Apache Traffic Server experiences a memory leak when processing HostDB SRV records. This flaw permits repeated handling of such records to gradually allocate memory without freeing it, potentially exhausting server resources and causing a denial of service. The weakness is captured by CWE‑401, indicating improper disposal of resources.

Apache Traffic Server components from versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are affected. Official patches are available in releases 9.2.15 and 10.1.4, which eliminate the leak.

The CVSS base score of 8.2 labels this vulnerability as high severity, while the EPSS score of less than 1 % suggests a very low likelihood of exploitation at the time of analysis. It is not listed in CISA’s KEV catalog. Although the precise attack vector is not detailed in the advisory, the flaw involves processing SRV records, implying that an attacker could trigger the leak by sending crafted SRV queries from a remote host, provided the server reaches for the database. There is no publicly available workaround beyond upgrading, so mitigation must rely on the vendor’s patch.