The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This stack‑based buffer overflow can lead to arbitrary code execution or denial of service. The weakness is classified as CWE‑121 and has a CVSS score of 8.2, indicating high severity. The description does not specify additional prerequisites, but the overflow occurs during normal processing of plugin input and can undermine the entire server process.

Affected are Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. All these releases expose the vulnerable txn_box plugin that lacks proper bounds checking.

This vulnerability has a CVSS score of 8.2 and an EPSS score of <1 %, indicating low current exploitation probability but still feasible. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote: an adversary can send crafted input to the Traffic Server instance that triggers the txn_box plugin, potentially leading to code execution or a crash. Proper authentication or additional controls are not stated, so it is inferred that the exploit may be achieved without privileged access as long as the vulnerable request is allowed.