The header_rewrite plugin in Apache Traffic Server can corrupt memory during cookie operations and CIDR condition matching, resulting in an out-of-bounds write (CWE‑787). This flaw may cause the server to crash or lead to data corruption. Based on the description, the corruption occurs while processing user-supplied headers, so the flaw is triggered by crafted HTTP traffic.

The affected versions are Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Users should verify whether their installation, including any custom or downstream distributions, includes the necessary patch before proceeding.

The CVSS score of 8.3 indicates high severity, while an EPSS score of less than 1% suggests that large‑scale exploitation is currently unlikely. The vulnerability is not listed in CISA KEV. The likely attack vector is through malicious HTTP requests that contain malformed cookie headers or CIDR conditions; the attacker requires network access to the Traffic Server instance. Although no public exploit has been documented, the potential for an out‑of‑bounds write means that, in theory, an attacker could attempt to leverage this flaw for arbitrary code execution, but such exploitation is not confirmed by the supplied data.