Apache Traffic Server EUVD-2026-107537

Exploitation requires that ATS is passing through a chunked transfer AND that trailer dropping (proxy.config.http.drop_chunked_trailers) is active: this is ON by default in 10.x (so versions 10.0.0-10.1.4 and 10.2.0 are exposed in default configuration), but OFF by default in 8.1.11 and 9.2.5-9.2.15, which are vulnerable ONLY where an operator has explicitly enabled the setting. The attacker must also send a chunked message that includes trailers for ATS to attempt to drop. Limiting factors: impact is confined to stalling individual transfers until the configured connection timeout (bounding resource hold time), there is no code execution or data exposure, and the 8.x/9.x branches depend on a non-default configuration.

This is a genuine but modest-severity denial-of-service issue, not a high-urgency priority. The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects a network-reachable, unauthenticated, low-complexity flaw with only LOW availability impact and no confidentiality or integrity impact - consistent with CWE-400 resource/connection exhaustion. The real-world impact is bounded: per the description, the bug stalls an individual chunked transfer until the connection times out rather than crashing the proxy, so A:L (not A:H) is appropriate. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public exploit was referenced - so there is no public exploit identified at time of analysis. One important nuance the signals do not fully capture: default-configuration exposure is version-dependent. Trailer dropping (proxy.config.http.drop_chunked_trailers) is ON by default in 10.x, so 10.0.0-10.1.4 and 10.2.0 are exploitable out of the box; 8.1.11 and 9.2.5-9.2.15 are affected ONLY if an operator explicitly enabled the feature, which materially lowers real-world exposure for those branches. PR:N is reasonable because no attacker credentials are needed, though exploitability on 8.x/9.x hinges on a non-default server-side setting rather than on the attacker.

A remote, unauthenticated attacker sends an HTTP request/response through an ATS proxy running with chunked-trailer dropping enabled, using a chunked transfer that includes trailers. Because ATS waits for trailer bytes it has already stripped, the transfer stalls and the connection is held open until it times out, tying up the connection and associated resources. Repeating this across many connections can degrade availability; no public exploit code was referenced.