Inconsistent interpretation of HTTP requests in Apache Traffic Server - CVE-2025-31699
Published: October 23, 2026
Vulnerability identifier: #VU157323
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-31699
CWE-ID: CWE-444
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to smuggle requests past access controls, disrupt other users' requests, or poison the cache.
The vulnerability exists due to improper HTTP request framing in Apache Traffic Server's origin connection pooling when a connection is returned to the shared pool while the origin is still waiting for a declared request body. A remote attacker can send a request without completing its declared body, including one using Expect: 100-continue, so that the origin interprets a later request as leftover body data, enabling request smuggling, request disruption, or cache poisoning.
Affected software
Apache Traffic Server
How to mitigate CVE-2025-31699
Install security update from vendor's website.
Apache Traffic Server - addressed in versions 9.2.16, 10.1.5, 10.2.1