{"id":"CVE-2025-31699","published":"2026-10-21T19:16:47.390","lastModified":"2026-10-23T12:18:04.473","description":"Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","cvssScore":8.9,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","cwes":["CWE-444"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Apache Traffic Server incorrectly returns backend connections to the shared pool before fully consuming the client's declared request body, allowing an attacker to smuggle subsequent requests through that connection, bypassing access controls and potentially poisoning caches.","exploitability":"Exploitation requires precise timing and control over the HTTP request stream; the attacker must send a partial request body while declaring a larger one (e.g., via Expect: 100-continue) and immediately follow with a second request on the same connection before the origin consumes the leftover data.","blast_radius":"Successful exploitation could let an unauthenticated attacker bypass access controls, disrupt legitimate users' requests, or inject malicious content into the cache, affecting all downstream clients served via the compromised connection.","remediation":"Upgrade to Apache Traffic Server version 9.2.16, 10.1.5, or 10.2.1, which contain the fix for this issue.","detection":"Look for abnormal HTTP/1.1 request sequences on backend connections where a subsequent request appears immediately after an incomplete request body, especially with mismatched Content-Length or Expect headers; such patterns may appear in ATS access logs or origin server logs as unexpected request framing anomalies.","tags":["http-smuggling","access-bypass","cache-poisoning","web-cache","backend-connection-pool"],"model":"garnet-coder","analyzedAt":"2026-10-26T08:54:54.768Z"}}