CVE-2025-55702: Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request
When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smuggle requests past the front end and desynchronize responses for other users.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.16 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.1.5 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.2.1
Event History
Frequently Asked Questions
Which deployments are realistically exposed to request smuggling?
Deployments where Apache Traffic Server sits behind a front-end proxy that shares connections to Traffic Server are exposed. In that arrangement, an attacker can smuggle requests past the front end and desynchronize responses for other users.
What does an attacker need to send to exploit this issue?
The attacker needs to send a POST request using Expect: 100-continue where the origin responds before reading the request body. The unread body can then be parsed by Traffic Server as a subsequent request.
Which versions should be upgraded?
Upgrade affected 9.x installations to 9.2.16, affected 10.1 installations to 10.1.5, or affected 10.2.0 installations to 10.2.1. The affected ranges are 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0.