Apache Traffic Server CVE-2026-65324

Exploitation requires that the Apache Traffic Server instance is serving HTTP/2 or HTTP/3 and that the affected code path dechunks (strips chunked transfer-encoding from) upstream responses - that dechunking-over-HTTP/2-or-HTTP/3 condition is the specific prerequisite. The attacker must act as a slow-reading client, deliberately consuming response data slowly across streams to prevent buffer drainage (reflected by CVSS AT:P). No authentication is needed (PR:N) and no user interaction is required (UI:N). Limiting factors: the attack only works against the HTTP/2 or HTTP/3 handling path (an instance serving only HTTP/1.1, or with H2/H3 disabled, is not exposed), and success depends on sustaining slow reads and holding streams open long enough to grow memory, so simple per-connection timeouts or memory limits reduce feasibility.

The CVSS 4.0 base score is 8.2 (High) with vector AV:N/AC:L/AT:P/PR:N/UI:N and impact isolated to availability (VA:H, VC/VI:N). The AT:P (attack requirement present) metric is meaningful here: exploitation depends on the attacker sustaining slow reads against streams carrying dechunked HTTP/2 or HTTP/3 responses, so it is not a single-packet trigger. No EPSS score, KEV listing, or POC was provided, so real-world exploitation pressure appears low-to-moderate: this is a resource-exhaustion DoS, not RCE or data disclosure. Priority should be driven by exposure - internet-facing ATS instances serving HTTP/2/3 warrant prompt patching, while the absence of any confidentiality/integrity impact and the timing-dependent attack requirement make this lower urgency than a network RCE of comparable score. No public exploit identified at time of analysis; no signal of active exploitation.

An attacker opens an HTTP/2 or HTTP/3 connection to an internet-facing Apache Traffic Server instance and requests resources whose upstream responses are chunked and dechunked by the proxy. By reading the returned stream extremely slowly (or not at all) across many concurrent streams, the attacker prevents the server from draining its buffers, causing memory to grow without bound until the process is starved or killed. No authentication or user interaction is required; no public POC is currently identified.