Apache Traffic Server Patch Fixes Request Smuggling Flaw in Versions Up to 10.2.0

Apache Traffic Server contains a parsing flaw that allows attackers to smuggle requests past front-end proxies. The vendor has released patched versions to address the issue in multiple release branches.

What happened

Apache Traffic Server versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, and 10.0.0 through 10.2.0 are affected by a request smuggling vulnerability. According to the National Vulnerability Database, the issue arises when a client sends a POST request with an Expect header set to 100-continue. If the origin server answers before reading the request body, Traffic Server incorrectly parses the remaining data on the client connection as the next request.

This behavior allows an attacker positioned behind a front-end proxy that shares connections to Traffic Server to bypass the proxy. The attacker can then desynchronize responses for other users by injecting unauthorized requests into the stream. The flaw is classified under CWE-444, which relates to unexpected external control of a resource.

Why it matters

The vulnerability carries a CVSS score of 8.7, which the National Vulnerability Database rates as high severity. Attackers can use this technique to bypass security controls implemented by front-end proxies. By desynchronizing responses, they may access data or functionality intended for other users. This type of request smuggling can disrupt the normal operation of web applications. It allows malicious actors to inject requests that the front-end proxy did not validate. The issue affects a wide range of Traffic Server installations across three major version branches. Organizations relying on Traffic Server for high-performance web caching and proxying are directly exposed.

What to watch

• Monitor Apache Security Advisories for updates on this vulnerability.
• Check internal logs for unusual request patterns or desynchronized responses.
• Verify that front-end proxies are configured to handle Expect headers securely.
• Review network traffic for signs of request smuggling attempts.

Who needs to act first

Teams should prioritize updating systems that face direct internet exposure or handle sensitive user data. Infrastructure that sits behind complex proxy chains is particularly vulnerable to this type of attack. Before deploying patches, IT managers should test the updates in a staging environment to ensure compatibility. Backing up configurations and current server states is essential before making changes. Organizations should also review their proxy configurations to minimize the risk of similar issues. Reducing the attack surface by restricting unnecessary connections can help mitigate exposure while patches are rolled out.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Apache Traffic Server

• Identify all instances of Apache Traffic Server running affected versions within your network.
• Apply the latest patched versions (9.2.16, 10.1.5, or 10.2.1) as soon as possible.
• Monitor server logs for signs of request smuggling or unexpected behavior after patching.
• Review front-end proxy configurations to ensure they handle Expect headers correctly.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Apache Traffic Server are affected by CVE-2025-55702?

Versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, and 10.0.0 through 10.2.0 are affected.

What is the CVSS score for this vulnerability?

The CVSS score is 8.7, which is rated as high severity.

Are there patches available for this issue?

Yes, patches are available in versions 9.2.16, 10.1.5, and 10.2.1.