Apache Traffic Server Uncontrolled Resource Consumption Vulnerability Leading to HTTP/2 Denial-of-Service

A denial-of-service vulnerability has been identified in Apache Traffic Server, specifically in the HTTP/2 protocol, where stalled flow-control can be exploited. This issue affects Apache Traffic Server versions 9.0.0 prior to 9.1.14 and 10.0.0 prior to 10.1.3.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition by causing stalled flow-control in HTTP/2, which can disrupt normal traffic management and processing.

Remediation

Users of Apache Traffic Server 9.x should upgrade to version 9.1.14 or later. Users of Apache Traffic Server 10.x should upgrade to version 10.1.3 or later.