The Apache Traffic Server ESI plugin contains a flaw that lets user‑specified URLs trigger uncontrolled recursion, permitting the server to repeatedly request URLs under attacker control. This results in server‑side request forgery, enabling the attacker to make requests on the server’s behalf to any internal or external resource, and the unbounded recursion can exhaust server resources, leading to denial of service. The underlying weakness is identified as CWE‑674.

The vulnerability affects Apache Traffic Server versions 8.0.0 to 8.1.9, 9.0.0 to 9.2.14, and 10.0.0 to 10.1.3. Users running any of these releases should upgrade to at least version 9.2.15 or 10.1.4, which contain the patch.

With a CVSS score of 8.2 the flaw is considered high severity. The EPSS score indicates that exploitation is currently unlikely, and it is not listed in CISA’s KEV catalog. Nevertheless, an attacker who can supply ESI content to the server could exploit the recursion flaw to force the traffic server to issue arbitrary HTTP requests (SSRF), and the infinite recursion may deplete CPU or memory, causing service interruption. The attack vector is likely remote, triggered by malformed or malicious ESI tags in HTTP responses.