The header_rewrite plugin in Apache Traffic Server can crash or corrupt memory during cookie operations and CIDR condition matching, leading to an out‑of‑bounds write (CWE‑787). The flaw may cause the server to crash or corrupt data, and it is triggered by crafted HTTP traffic that includes malformed cookie headers or CIDR conditions.

The affected versions are Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Users should verify whether their installation, including any custom or downstream distributions, includes the necessary patch before proceeding.

The CVSS score of 8.3 indicates high severity, while an EPSS score of less than 1% suggests that large‑scale exploitation is currently unlikely. The vulnerability is not listed in CISA KEV. The likely attack vector is through malicious HTTP requests that contain malformed cookie headers or CIDR conditions; the attacker requires network access to the Traffic Server instance. Although no public exploit has been documented, the potential for an out‑of‑bounds write means that, in theory, an attacker could attempt to leverage this flaw for arbitrary code execution, but such exploitation is not confirmed by the supplied data.