Key points
- Apache Traffic Server versions 8.0.0 through 10.2.0 are affected by CVE-2025-31699.
- The flaw enables HTTP request smuggling, cache poisoning, and disruption of other users' requests.
- Fixes are available in versions 9.2.16, 10.1.5, and 10.2.1.
Apache Traffic Server administrators must apply updates immediately to address a high-severity vulnerability. The flaw, tracked as CVE-2025-31699, affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, and 10.0.0 through 10.2.0. The Apache Software Foundation has released patched versions 9.2.16, 10.1.5, and 10.2.1 to resolve the issue.
In plain English
The vulnerability stems from how the server manages connections to origin servers. When a client declares it will send a request body but fails to send it all, the server may return that connection to its shared pool prematurely. This happens even when the client uses the Expect: 100-continue header. The origin server then misinterprets subsequent requests as leftover data from the previous incomplete request.
The background
This misinterpretation allows an attacker to smuggle requests past the server's access controls. According to the NVD record, the weakness is classified as CWE-444. An attacker can use this flaw to disrupt requests from other users or poison the server's cache. The CVSS score for this issue is 8.9, which rates it as high severity.
What changes now
Users running affected versions should upgrade to the latest patched releases. The Apache Software Foundation recommends moving to version 9.2.16, 10.1.5, or 10.2.1. These updates fix the connection handling logic that previously allowed request smuggling. No other mitigation strategies are mentioned in the advisory.
Who needs to act first
Teams usually prioritize systems exposed to the public internet, as these face the highest risk of exploitation. Check whether your production environments run vulnerable versions before testing updates in isolated stages. Back up configuration files and application data to ensure a safe rollback path if the upgrade causes unexpected behavior. Monitor server logs for anomalous request patterns that might indicate active exploitation while planning the rollout.
What to do and how to stay safe: Apache Traffic Server
- Identify all instances of Apache Traffic Server running versions 8.0.0 through 10.2.0.
- Apply the specific patched versions recommended by the vendor to your environment.
- Monitor access logs for signs of request smuggling or cache poisoning attempts.
- Review firewall rules to restrict unnecessary access to the proxy servers.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Apache Traffic Server are vulnerable?
Versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, and 10.0.0 through 10.2.0 are affected.
What is the severity of CVE-2025-31699?
The vulnerability has a CVSS score of 8.9, which is rated as high severity.
How can an attacker exploit this flaw?
Attackers can smuggle requests past access controls, disrupt other users' requests, or poison the cache.
