Live › vulnerability › CVE-2025-31699
Go to dashboardApache Traffic Server can reuse an origin connection while the origin still waits for a request body, so the origin reads the next request as leftover data. An attacker can smuggle requests past ATS access controls, disrupt other users, or poison the cache.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| Apache Traffic Server | vendor | >= 8.0.0, <= 8.1.11; >= 9.0.0, <= 9.2.15; >= 10.0.0, <= 10.1.4; 10.2.0 | 9.2.16, 10.1.5, 10.2.1 |
Check the installed ATS version (for example with traffic_server -V or the package manager) and compare it to the affected ranges: 8.0.0 to 8.1.11, 9.0.0 to 9.2.15, 10.0.0 to 10.1.4, and 10.2.0.
Upgrade to 9.2.16, 10.1.5, or 10.2.1, depending on your release line.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
This page as .md · .json · in your agent: get_signal("CVE-2025-31699")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.