Apache Traffic Server: Request smuggling vulnerability (CVE-2025-31699)
Apache Traffic Server is vulnerable to request smuggling due to the improper handling of shared origin connections when client request bodies are incomplete, allowing cache poisoning and access control bypass.
CVE search metadata
CVE search record: CVE-2025-31699. Severity: high. CVSS: 8.9. KEV: no. Product: Traffic Server (8.0.0-8.1.11, 9.0.0-9.2.15, 10.0.0-10.1.4, 10.2.0), Traffic Server. Brief: Apache Traffic Server: Request smuggling vulnerability (CVE-2025-31699). Brief link: https://feed.craftedsignal.io/briefs/2026-10-apache-traffic-server-request-smuggling/
CVE search record: CVE-2026-111816. KEV: no. Product: Traffic Server (8.0.0-8.1.11, 9.0.0-9.2.15, 10.0.0-10.1.4, 10.2.0), Traffic Server. Brief: Apache Traffic Server: Request smuggling vulnerability (CVE-2025-31699). Brief link: https://feed.craftedsignal.io/briefs/2026-10-apache-traffic-server-request-smuggling/
Triage facts
Revision 1- Applicability
- Traffic Server (8.0.0-8.1.11, 9.0.0-9.2.15, 10.0.0-10.1.4, 10.2.0), Traffic Server
- Evidence
- Unknown
- Severity
- Critical
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 21, 19:58 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A1Likely
What's new
- 1. added coverage for Traffic Server Oct 21, 19:59 via nvd
Apache Traffic Server (ATS) incorrectly returns an origin connection to the shared pool while the connection is still expecting a request body from the client, including instances involving the 'Expect: 100-continue' header. An attacker can exploit this behavior by sending a partial request, causing the origin to interpret subsequent requests from other users as leftover body data. This allows for request smuggling, potentially leading to unauthorized access, cross-user request disruption, or cache poisoning.
Impact
Successful exploitation permits an attacker to bypass ATS access controls, intercept or disrupt legitimate user requests, and perform cache poisoning. The vulnerability carries a CVSS v3.1 base score of 8.9.
Recommendation
Upgrade Apache Traffic Server instances to the patched versions: 9.2.16, 10.1.5, or 10.2.1.
Mitigations
Upgrade Apache Traffic Server to 9.2.16, 10.1.5, or 10.2.1
CVE-2025-31699