Request Smuggling Vulnerability in Apache Traffic Server by The Apache Software Foundation
CVE-2025-31699

9.1CRITICAL

Key Information:

Vendor

Apache
Status
Apache Traffic Server
Vendor
CVE Published:
21 October 2026

What is CVE-2025-31699?

Apache Traffic Server can inadvertently return an origin connection to the shared pool while the origin is still awaiting a complete request body from the client. This can occur even when the client has sent an Expect: 100-continue request. As a result, an attacker may exploit this behavior to smuggle malicious requests past ATS access controls, potentially disrupting legitimate user requests or poisoning the cache. To mitigate this issue, users should upgrade to versions 9.2.16, 10.1.5, or 10.2.1.

Affected Version(s)

Apache Traffic Server 8.0.0 <= 8.1.11

Apache Traffic Server 9.0.0 <= 9.2.15

Apache Traffic Server 10.0.0 <= 10.1.4

References

https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb1...
vendor-advisory

CVSS V4

Score:
9.1
Severity:
CRITICAL
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Martin van Kervel Smedshammer
Nick Muerdter
.