CVE-2025-55702 — Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request

Description (CNA)

When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smuggle requests past the front end and desynchronize responses for other users. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Traffic Server	affected 8.0.0 through 8.1.11; affected 9.0.0 through 9.2.15; affected 10.0.0 through 10.1.4; affected 10.2.0

CWE

CWE-444

References

https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.