The Apache Traffic Server regex_remap plugin has a stack-based buffer overflow that is triggered by attacker-controlled substitution input. When the overflow occurs, it can overwrite return addresses or other control data on the stack, allowing an attacker to execute arbitrary code or crash the server, thereby compromising confidentiality, integrity, and availability.

Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are affected. The vulnerability resides within the regex_remap plugin, a component used to transform URLs during the remapping process.

With a CVSS score of 9.2 the vulnerability is considered critical. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, yet the high severity warrants immediate attention. The most likely attack vector is via crafted remap requests sent over the network to the Traffic Server. Successful exploitation would require network access to the server or the ability to inject malicious patterns into the substitution input. The vulnerability is not yet listed in the CISA KEV catalog, indicating no widespread use of publicly available payloads, but the potential impact is high.