Apache Traffic Server contains a flaw in which certain plugins can reset the internal counter that limits how many HTTP redirects a request may follow. By resetting that counter, an attacker can cause the server to follow an unlimited number of redirects, turning the server into an amplifier for Server‑Side Request Forgery (SSRF). This vulnerability is classified as CWE‑918 and enables a malicious actor to generate large volumes of outbound traffic to arbitrary hostnames, potentially consuming network bandwidth, exhausting target resources, or delivering further malicious payloads.

Apache Software Foundation’s Apache Traffic Server is vulnerable in the following releases: version 8.0.0 through 8.1.11, version 9.0.0 through 9.2.14, and version 10.0.0 through 10.1.3. All other releases are not affected.

The flaw carries a CVSS score of 8.2, indicating high severity, and an EPSS score of less than 1%, implying a low probability of exploitation in the near term. It is not listed in CISA’s KEV catalog. Based on the description, the likely attack path involves an attacker having control over or being able to influence the configuration of a plugin that can reset the retry counter, after which the server is induced to perform many redirects to a target host. This bypass of the redirect limit can be used to amplify SSRF traffic from the compromised server.