Executive brief
Apache Traffic Server, a high-performance caching proxy used to speed up web content delivery, is vulnerable to a memory exhaustion attack. An attacker acting as a slow client can force the server to consume excessive memory when processing certain types of web traffic. This can lead to a denial-of-service condition, causing the server to crash or become unresponsive to legitimate users.
Technical details
A resource consumption vulnerability (CWE-400) exists in Apache Traffic Server due to improper management of buffer limits. When dechunking responses over HTTP/2 or HTTP/3, the server fails to enforce per-stream buffer caps. A remote, unauthenticated attacker can exploit this by acting as a slow client, causing the server to accumulate data in memory without bound. This leads to memory exhaustion and a denial-of-service (DoS) state. The issue is resolved in versions 9.2.15 and 10.1.4.
Affected products
- Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, 10.0.0 through 10.1.3
Timeline
- 2026-07-29: disclosed
- 2026-07-29: advisory