Apache Traffic Server EUVD-2026-50227

Exploitation requires that the target Apache Traffic Server instance has the ts_lua plugin loaded and active (configured via plugin.config or per-remap in remap.config) - proxies without ts_lua are not affected. No authentication is required (PR:N) and no user interaction is needed (UI:N), and the proxy must be network-reachable by the attacker (AV:N). The defining limiter is the CVSS 4.0 AT:P (attack requirement present): a specific condition beyond the attacker's control - tied to the plugin's initialization, transform context, or per-instance state handling - must hold for the resource-consumption path to trigger, which is why this is not a trivially reliable remote crash against every Lua-enabled deployment. Impact is limited to availability (VA:H, with VC:N/VI:N).

The signals are internally consistent but point to a moderate, not top-tier, real-world priority. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, VA:H, all confidentiality and integrity impact N) confirms a network-reachable, unauthenticated, availability-only issue - no data disclosure or code execution. The base score of 8.2 is driven largely by the network vector and high availability impact, but the AT:P (attack requirement present) metric explicitly tempers it: successful exploitation depends on a condition the attacker does not fully control, which is why the score is not higher. No EPSS value was provided, it is not in CISA KEV (no confirmed active exploitation), and no POC was supplied, so exploitation is unproven. The single largest limiting factor is that ts_lua is an optional plugin - environments not running Lua scripting are not exposed at all. Bottom line: a genuine uptime/DoS concern for ATS fleets that use ts_lua, but not an emergency for the broader ATS install base, and clearly not a confidentiality/integrity breach.

An attacker who can send HTTP requests to an internet-facing ATS proxy that has the ts_lua plugin enabled repeatedly triggers the mishandled transform/per-instance state path, causing the proxy to leak or exhaust resources until it crashes or stops serving traffic. Because the CVSS attack requirement is Present (AT:P), the attacker needs the right condition to be met - such as a specific ts_lua hook or transform being configured - rather than any arbitrary request. No public exploit code is identified at time of analysis.