CVE-2025-31699

Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

CVSS v3 8.9 HIGH

8.9^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc

Configurations

No configuration.

History

28 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Apache Traffic Server puede devolver una conexión de origen al pool compartido mientras el origen aún está esperando el cuerpo de la solicitud que el cliente declaró pero nunca envió completamente, incluso cuando el cliente utilizó Expect: 100-continue. El origen entonces lee una solicitud posterior en esa conexión como datos residuales del cuerpo, lo que permite a un atacante introducir solicitudes por delante de los controles de acceso de ATS, interrumpir las solicitudes de otros usuarios o envenenar la caché.\n\nEste problema afecta a Apache Traffic Server: desde la versión 8.0.0 hasta la versión 8.1.11 incluida, desde la versión 9.0.0 hasta la versión 9.2.15 incluida, desde la versión 10.0.0 hasta la versión 10.1.4 incluida y la versión 10.2.0.\n\nSe recomienda a los usuarios actualizar a la versión 9.2.16, 10.1.5 o 10.2.1, que corrigen el problema.

21 Oct 2026, 19:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-21 19:16

Updated : 2026-10-28 14:10

NVD link : CVE-2025-31699

Mitre link : CVE-2025-31699

CVE.ORG link : CVE-2025-31699

JSON object : View

Products Affected

No product.

CWE

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

{"id": "CVE-2025-31699", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-31699", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-22T23:05:01.570814Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@apache.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.9, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "security@apache.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "versions": [{"status": "affected", "version": "8.0.0", "versionType": "semver", "lessThanOrEqual": "8.1.11"}, {"status": "affected", "version": "9.0.0", "versionType": "semver", "lessThanOrEqual": "9.2.15"}, {"status": "affected", "version": "10.0.0", "versionType": "semver", "lessThanOrEqual": "10.1.4"}, {"status": "affected", "version": "10.2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-21T19:16:47.390", "references": [{"url": "https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "source": "security@apache.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-444"}]}], "descriptions": [{"lang": "en", "value": "Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue."}, {"lang": "es", "value": "Apache Traffic Server puede devolver una conexi\u00f3n de origen al pool compartido mientras el origen a\u00fan est\u00e1 esperando el cuerpo de la solicitud que el cliente declar\u00f3 pero nunca envi\u00f3 completamente, incluso cuando el cliente utiliz\u00f3 Expect: 100-continue. El origen entonces lee una solicitud posterior en esa conexi\u00f3n como datos residuales del cuerpo, lo que permite a un atacante introducir solicitudes por delante de los controles de acceso de ATS, interrumpir las solicitudes de otros usuarios o envenenar la cach\u00e9.\\n\\nEste problema afecta a Apache Traffic Server: desde la versi\u00f3n 8.0.0 hasta la versi\u00f3n 8.1.11 incluida, desde la versi\u00f3n 9.0.0 hasta la versi\u00f3n 9.2.15 incluida, desde la versi\u00f3n 10.0.0 hasta la versi\u00f3n 10.1.4 incluida y la versi\u00f3n 10.2.0.\\n\\nSe recomienda a los usuarios actualizar a la versi\u00f3n 9.2.16, 10.1.5 o 10.2.1, que corrigen el problema."}], "lastModified": "2026-10-28T14:10:00.220", "sourceIdentifier": "security@apache.org"}