Apache Traffic Server includes experimental plugins that can trigger memory‑safety and limit‑bypass errors. These errors are classified under CWE‑787 and can result in out‑of‑bounds memory reads or writes. The impact is that an attacker could potentially execute arbitrary code or cause a denial of service. The description does not detail the exact circumstances, but the nature of the flaw suggests a severe compromise of confidentiality, integrity, or availability when triggered.

Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are affected. Users should verify their installed versions against these ranges.

The CVSS score of 8.4 classifies the bug as high severity, while the EPSS score of less than 1% indicates a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the memory‑corruption nature and the affected experimental plugins, the most likely attack vector is remote through a plugin‑enabled request or buffer overflow in plugin code. Once triggered, an attacker could gain code execution, compromising the server.