Apache Traffic Server eliminates the per-stream buffer limit when dechunking HTTP/2 or HTTP/3 responses. This change allows a client that sends data at a slower rate than the server can consume to cause the server to allocate an increasing amount of memory for that stream, eventually exhausting the system’s RAM. The resulting denial‑of‑service can render the server unresponsive for all users. The vulnerability is a classic example of CWE‑400, an Uncontrolled Resource Consumption flaw.

The issue covers Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Any deployment running any of these releases is susceptible.

The CVSS score of 8.2 indicates a high severity. The EPSS score is listed as less than 1%, suggesting a low likelihood of current exploitation but still possible; it does not rule out future attacks. The flaw is not included in the CISA Known Exploited Vulnerabilities catalog. Attackers would require direct access to the server and a client capable of sending a slow HTTP/2 or HTTP/3 response, which is a reasonable assumption for an open or poorly protected service. Successful exploitation results in memory exhaustion and a denial‑of‑service for all clients.