Apache Traffic Server HostDB SRV Record Memory Leak

Apache Traffic Server contains a memory leak vulnerability (CWE-401) in its handling of HostDB SRV records that affects multiple versions across the 8.x, 9.x, and 10.x release lines. This vulnerability allows memory to accumulate without proper deallocation when the server processes Service (SRV) DNS records, potentially leading to denial of service through resource exhaustion. Organizations running affected versions—8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3—face increased risk if their Traffic Server instances handle DNS resolution or load balancing with SRV record lookups. The high CVSS score of 7.5 reflects the availability impact that sustained memory leaks can inflict on critical infrastructure.

While this specific CVE does not map directly to MITRE ATT&CK techniques in the vulnerability disclosure, Casky's AI-driven analysis with extended reasoning capabilities would identify the underlying resource exhaustion patterns that practitioners should monitor. Security teams using Casky would benefit from behavioral detection rules focused on process memory growth anomalies, abnormal DNS query patterns targeting SRV records, and performance degradation indicators in reverse proxy or load balancing infrastructure. By correlating these signals across your environment, practitioners can identify exploitation attempts even in variants or attack chains that leverage this vulnerability as a stepping stone. The absence of mapped skills in this spotlight underscores the importance of immediate patching to versions 9.2.15 or 10.1.4, combined with proactive memory and resource monitoring while upgrades are staged.