The uri_signing and url_sig plugins can exhaust the stack or crash when processing attacker supplied input. This stack exhaustion can lead to a denial of service by bringing the Traffic Server process down. The flaw is a classic stack‑based buffer overflow (CWE‑121) and does not provide remote code execution but does terminate the service.

Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are affected. The problem is fixed in 9.2.15 and 10.1.4.

The CVSS score of 8.2 indicates a high‑severity vulnerability, but the EPSS score of less than 1 % shows that exploitation is unlikely to be common. The flaw lives in the plugins and it is inferred that the vulnerability can be triggered by a remote user sending malformed requests; the likely attack vector is remote input via HTTP requests that trigger stack exhaustion. Because it is not listed in CISA KEV, no active attacks have been observed yet. Nonetheless, the high severity and potential for service disruption warrant immediate remediation.