The Cripts framework in Apache Traffic Server contains out‑of‑bounds memory writes, path‑traversal, and use‑after‑free conditions that violate program memory safety. These flaws can be abused to corrupt process memory and potentially execute arbitrary code, compromising the confidentiality, integrity, and availability of the affected system. The weakness is classified as CWE‑787.

Vendors affected are the Apache Software Foundation’s Apache Traffic Server, versions 10.0.0 through 10.1.3. Any deployment running one of these releases is vulnerable unless upgraded.

The CVSS score of 8.3 indicates high severity, and the EPSS score of less than 1% suggests a low current likelihood of exploitation. It is not listed in CISA KEV. The likely attack vector is remote exploitation via the Traffic Server service, although the description does not explicitly state whether local or remote access is required. Exploitation would require reaching the vulnerable Cripts framework component.