---
id: "CVE-2025-31699"
kind: "vulnerability"
aliases: ["CVE-2025-31699"]
title: "Apache Traffic Server: request smuggling lets attackers bypass access controls and poison cache"
severity: "critical"
cvss: 9.1
epss: 0.00266
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Apache Traffic Server", "fixed": ["9.2.16", "10.1.5", "10.2.1"], "affected": ">= 8.0.0, <= 8.1.11; >= 9.0.0, <= 9.2.15; >= 10.0.0, <= 10.1.4; 10.2.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apache-traffic-server", "cache", "request-smuggling", "reverse-proxy", "runtime", "self-hosted"]
not_affected_if: ["version-outside-affected-ranges"]
published_at: "2026-10-21T19:16:47+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31699", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:27:22+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-31699", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Apache Traffic Server: request smuggling lets attackers bypass access controls and poison cache

Apache Traffic Server can reuse an origin connection while the origin still waits for a request body, so the origin reads the next request as leftover data. An attacker can smuggle requests past ATS access controls, disrupt other users, or poison the cache.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apache Traffic Server affected >= 8.0.0, <= 8.1.11; >= 9.0.0, <= 9.2.15; >= 10.0.0, <= 10.1.4; 10.2.0 fixed 9.2.16, 10.1.5, 10.2.1

## How to check

Check the installed ATS version (for example with traffic_server -V or the package manager) and compare it to the affected ranges: 8.0.0 to 8.1.11, 9.0.0 to 9.2.15, 10.0.0 to 10.1.4, and 10.2.0.

## Fix

Upgrade to 9.2.16, 10.1.5, or 10.2.1, depending on your release line.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-31699
- 2026-10-23T22:27:22+00:00 analyst — Affected/fixed versions confirmed from the Apache CNA text (via NVD, GHSA, Rapid7). I did not read the Apache mailing-list thread, so trigger conditions and any config workaround are unknown. No exploitation or public PoC found (not in KEV, EPSS under 1%). No community posts checked.
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2025-31699

## Documents

- [advisory] NVD CVE-2025-31699 (from Apache CNA) https://nvd.nist.gov/vuln/detail/CVE-2025-31699
- [describes] GHSA-4h97-h3mf-j6w7 https://github.com/advisories/GHSA-4h97-h3mf-j6w7
- [mentions] Rapid7 CVE-2025-31699 https://www.rapid7.com/db/vulnerabilities/cve-2025-31699/

## From the sources

Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_