The Apache Traffic Server txn_box plugin contains a stack‑based buffer overflow that can be triggered by attacker‑controlled input. When this flaw is exploited it may lead to arbitrary code execution, denial of service, or compromise of the server’s integrity. The weakness is classified as CWE‑121 and has a CVSS score of 8.2, indicating high severity. The description does not specify additional prerequisites, but the overflow occurs during normal processing of plugin input and can undermine the entire server process.

Affected are Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. All these releases expose the vulnerable txn_box plugin that lacks proper bounds checking.

This vulnerability has a CVSS score of 8.2 and an EPSS score of <1 %, indicating low current exploitation probability but still feasible. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote: an adversary can send crafted input to the Traffic Server instance that triggers the txn_box plugin, potentially leading to code execution or a crash. Proper authentication or additional controls are not stated, so it is inferred that the exploit may be achieved without privileged access as long as the vulnerable request is allowed.