CVE-2025-31698: Apache Traffic Server: Client IP address from PROXY protocol is not used for ACL
ACL configured in ipallow.config or remap.config does not use IP addresses that are provided by PROXY protocol.
Users can use a new setting (proxy.config.acl.subjects) to choose which IP addresses to use for the ACL if Apache Traffic Server is configured to accept PROXY protocol. This issue affects undefined: from 10.0.0 through 10.0.6, from 9.0.0 through 9.2.10.
Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/trafficserverto a version that resolves this vulnerability.Fixed in 9.2.5+ds-0+deb12u4 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.11 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.0.6 - Configuration
Configure proxy.config.acl.subjects to choose which IP addresses are used for ACL evaluation when PROXY protocol is enabled.
Apache Traffic Server proxy.config.acl.subjects = IP addresses to use for the ACL
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31698?
CVE-2025-31698 has been classified as a medium severity vulnerability.
How do I fix CVE-2025-31698?
To fix CVE-2025-31698, users should update their configuration to include the new setting proxy.config.acl.subjects to properly utilize IP addresses provided by PROXY protocol.
What software is affected by CVE-2025-31698?
CVE-2025-31698 affects Apache Traffic Server versions 9.0.0 to 9.2.10 and 10.0.0 to 10.0.6.
What is the impact of CVE-2025-31698?
The impact of CVE-2025-31698 is that the Access Control List (ACL) may not correctly recognize IP addresses supplied via the PROXY protocol.
Is it necessary to upgrade Apache Traffic Server to mitigate CVE-2025-31698?
Upgrading Apache Traffic Server is not strictly necessary if the proxy.config.acl.subjects setting is properly configured, but updating to the latest version is recommended for improved security.