Apache Traffic Server EUVD-2025-209188

This denial-of-service vulnerability presents moderate real-world risk despite the absence of a CVSS score and severity metric. The attack vector is unauthenticated and remote (POST requests are sent over HTTP/HTTPS), and the attack complexity is likely low-the crash occurs under 'a certain condition', implying a reproducible, predictable trigger rather than a race condition or complex setup. EPSS data is not available, but the KEV status is not confirmed as active exploitation. However, the simplicity of the attack surface (HTTP POST handling is core functionality) and the lack of authentication barriers mean that once a working exploit (proof-of-concept payload) is public, widespread abuse would be likely. The availability of a workaround (disabling request buffering at the default setting) suggests the condition is non-default or edge-case, reducing mass-exploitation likelihood for stock deployments. Prioritize patching for high-availability or internet-facing Traffic Server instances; lower-risk for internal proxy use behind validated firewalls.

An unauthenticated remote attacker sends a crafted HTTP POST request to a vulnerable Apache Traffic Server instance. The malformed POST data (e.g., unusual Content-Length, truncated body, or invalid chunked encoding) triggers the crash condition in the request buffering logic, causing the server process to terminate. If no automatic process restart is configured, this results in denial of service; repeated requests can sustain the outage. No public proof-of-concept code has been independently confirmed at time of analysis.