{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/traffic-server-8.0.0-8.1.11-9.0.0-9.2.15-10.0.0-10.1.4-10.2.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.9,"id":"CVE-2025-31699"},{"id":"CVE-2026-111815"},{"id":"CVE-2026-111816"},{"id":"CVE-2026-111813"},{"id":"CVE-2026-111810"},{"id":"CVE-2026-111814"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Traffic Server (8.0.0-8.1.11, 9.0.0-9.2.15, 10.0.0-10.1.4, 10.2.0)","Traffic Server","Traffic Server (8.0.1 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, 10.2.0)","Traffic Server (9.2.15, 10.1.4, 10.2.0)","Traffic Server (9.0.0 through 9.2.15, 10.0.0 through 10.1.4, 10.2.0)","Traffic Server (8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, 10.2.0)"],"_cs_severities":["critical"],"_cs_tags":["request-smuggling","vulnerability","webserver","cache-poisoning","cve-2026-111816","rce","cve-2026-111813"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Traffic Server (ATS) incorrectly returns an origin connection to the shared pool while the connection is still expecting a request body from the client, including instances involving the 'Expect: 100-continue' header. An attacker can exploit this behavior by sending a partial request, causing the origin to interpret subsequent requests from other users as leftover body data. This allows for request smuggling, potentially leading to unauthorized access, cross-user request disruption, or cache poisoning.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation permits an attacker to bypass ATS access controls, intercept or disrupt legitimate user requests, and perform cache poisoning. The vulnerability carries a CVSS v3.1 base score of 8.9.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade Apache Traffic Server instances to the patched versions: 9.2.16, 10.1.5, or 10.2.1.\u003c/p\u003e\n","date_modified":"2026-10-21T21:41:03Z","date_published":"2026-10-21T19:58:34Z","id":"https://feed.craftedsignal.io/briefs/2026-10-apache-traffic-server-request-smuggling/","summary":"Apache Traffic Server is vulnerable to request smuggling due to the improper handling of shared origin connections when client request bodies are incomplete, allowing cache poisoning and access control bypass.","title":"Apache Traffic Server: Request smuggling vulnerability (CVE-2025-31699)","url":"https://feed.craftedsignal.io/briefs/2026-10-apache-traffic-server-request-smuggling/"}],"language":"en","title":"CraftedSignal Threat Feed - Traffic Server (8.0.0-8.1.11, 9.0.0-9.2.15, 10.0.0-10.1.4, 10.2.0)","version":"https://jsonfeed.org/version/1.1"}