CVE-2025-31699: Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling
Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.16 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.1.5 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.2.1
Event History
Frequently Asked Questions
Which deployments are affected?
Apache Traffic Server deployments running versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, or 10.2.0 are affected.
What does an attacker need to exploit this issue?
An attacker needs network access to send requests through Traffic Server. They can declare a request body and not fully send it, including when using Expect: 100-continue, causing a reused origin connection to interpret a later request as body data.
What is the recommended remediation?
Upgrade to Apache Traffic Server 9.2.16, 10.1.5, or 10.2.1, depending on the supported release line in use. These versions fix the issue.