Request Smuggling Vulnerability in Apache Traffic Server

CVE-2025-55702

What is CVE-2025-55702?

A request smuggling vulnerability exists in Apache Traffic Server due to improper parsing of unread body data when handling POST requests with 'Expect: 100-continue'. An attacker controlling a front-end proxy can exploit this flaw to send malicious requests that bypass security measures, potentially leading to response desynchronization issues for legitimate users. It is crucial for users to upgrade to the patched versions (9.2.16, 10.1.5, or 10.2.1) to mitigate the risks associated with this vulnerability.

References