Technical impact
The ts_lua plugin in Apache Traffic Server mishandles initialization, transform context, and per-instance state. The description does not specify the exact consequences, but based on typical outcomes of such deficiencies it is inferred that resource leaks or improper resource cleanup could occur, potentially exhausting memory or other system resources. This weakness maps to CWE‑400 and appears to target availability, with no mention of confidentiality or integrity impacts.
Affected Systems
Affected by the Apache Traffic Server product from the Apache Software Foundation. Versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are vulnerable. The issue is fixed in 9.2.15 and 10.1.4.
Risk and Exploitability
The CVSS score of 8.2 indicates a high severity impact if exploited. However, the EPSS score of less than 1% suggests a very low probability of exploitation at present, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector involves an attacker manipulating or sending crafted requests to the Traffic Server, or modifying the server’s configuration to invoke the ts_lua plugin in a way that triggers the resource leakage. Although no exploitation has been publicly reported, the potential for a denial of service exists if an attacker can interact with the server.
