The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker‑controlled URLs. This allows an attacker to trigger server‑side request forgery by injecting malicious ESI content, causing the server to repeatedly request arbitrary internal or external URLs. The uncontrolled recursion can exhaust CPU or memory resources, potentially leading to denial of service. The vulnerability is classified as CWE‑674.

The vulnerability affects Apache Traffic Server versions 8.0.0 to 8.1.11, 9.0.0 to 9.2.14, and 10.0.0 to 10.1.3. Users running any of these releases should upgrade to at least version 9.2.15 or 10.1.4, which include the fix.

With a CVSS score of 8.2 the flaw is considered high severity. The EPSS score indicates that exploitation is currently unlikely, and it is not listed in CISA’s KEV catalog. Nevertheless, an attacker who can supply ESI content to the server could exploit the recursion flaw to force the traffic server to issue arbitrary HTTP requests (SSRF), and the infinite recursion may deplete CPU or memory, causing service interruption. The attack vector is likely remote, triggered by malformed or malicious ESI tags in HTTP responses.