The vulnerability involves memory‑safety and limit‑bypass flaws in several experimental plugins for Apache Traffic Server. These bugs fall under CWE‑787 and enable an attacker to perform out‑of‑bounds memory writes or reads, potentially leading to arbitrary code execution or denial of service. The description does not detail the exact circumstances, but the nature of the flaw suggests severe compromise of confidentiality, integrity, or availability when triggered.

Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are affected. Users should verify their installed versions against these ranges.

The CVSS score of 8.4 classifies the bug as high severity, while the EPSS score of less than 1% indicates a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the memory‑corruption nature and the affected experimental plugins, the most likely attack vector is remote through a plugin‑enabled request or buffer overflow in plugin code. Once triggered, an attacker could gain code execution, compromising the server.