A plugin in Apache Traffic Server can reset the retry counter that limits the number of redirects a request may follow. By doing so, an attacker can circumvent the redirect limit and trigger repeated redirects, turning the server into a vehicle for amplifying Server Side Request Forgery (SSRF) attacks. This flaw is classified as CWE‑918 and enables a malicious actor to increase the volume of outbound traffic to target hosts, potentially exhausting network resources and causing denial of service or facilitating further malicious payload delivery. The impact is the ability to drive amplified traffic from the compromised server to arbitrary internal or external endpoints, which may leak sensitive data or consume significant bandwidth.

Apache Software Foundation’s Apache Traffic Server is affected in the following releases: version 8.0.0 through 8.1.9, version 9.0.0 through 9.2.14, and version 10.0.0 through 10.1.3.

The flaw has a CVSS score of 8.2, indicating a high severity. The EPSS score is less than 1%, suggesting a low probability of exploitation in the near term, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, an attacker who can control or influence the behaviour of the vulnerable plugin—either directly through configuration or indirectly via injected traffic—can exploit the bypass. The usual attack path involves using malicious or misconfigured plugins to reset the redirect counter, then making the server perform a large number of redirects against a target, thereby amplifying the SSRF payload. The vulnerability can be handed off to internal network resources, making it especially dangerous for servers that have broad network reach or are used as reverse proxies.