The vulnerability lies in a buffer overrun within the chunk decoder of the multiplexer plugin in Apache Traffic Server. An attacker can feed oversize upstream data that causes the decoder to write beyond its allocated buffer, leading to a crash or unresponsive state. This flaw is a classic out‑of‑bounds write (CWE‑787) that compromises the availability of the server process.

Apache Traffic Server versions 8.0.0‑8.1.9, 9.0.0‑9.2.14, and 10.0.0‑10.1.3 are affected. The issue arises when the multiplexer plugin is active; upgrading to 9.2.15 or 10.1.4 removes the bug.

The CVSS score of 6.3 indicates a medium severity, and the EPSS score of less than 1% suggests that exploitation is unlikely to be widespread. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via network traffic from upstream proxies or clients that can send arbitrary sized chunks to the server, bypassing any size limits. The flaw can cause an abrupt termination of the Traffic Server process, leading to downtime until a restart or reload occurs.