The ts_lua plugin in Apache Traffic Server mishandles initialization, transform context, and per-instance state, causing resource leaks that can exhaust memory or other system resources. This weakness maps to CWE‑400 and can lead to a denial of service by rendering the server unavailable to legitimate clients. The description does not mention any impact on confidentiality or integrity, so the primary concern is availability.

Affected by the Apache Traffic Server product from the Apache Software Foundation. Versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are vulnerable. The issue is fixed in 9.2.15 and 10.1.4.

The CVSS score of 8.2 indicates a high severity impact if exploited. However, the EPSS score of less than 1% suggests a very low probability of exploitation at present, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector involves an attacker manipulating or sending crafted requests to the Traffic Server, or modifying the server’s configuration to invoke the ts_lua plugin in a way that triggers the resource leakage. Although no exploitation has been publicly reported, the potential for a denial of service exists if an attacker can interact with the server.