CVE-2025-55702

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 8.1.11 Apache Traffic Server versions 9.0.0 through 9.2.15 Apache Traffic Server versions 10.0.0 through 10.1.4 Apache Traffic Server version 10.2.0

Description When a client sends a POST request with the Expect: 100-continue header and the origin server responds before reading the body, the software parses the unread body remaining on the client connection as the subsequent request. An attacker positioned behind a front-end proxy that shares connections to the server can exploit this behavior to smuggle requests past the front end and desynchronize responses for other users.

Recommendations Upgrade versions 8.0.0 through 8.1.11 to version 9.2.16. Upgrade versions 9.0.0 through 9.2.15 to version 9.2.16. Upgrade versions 10.0.0 through 10.1.4 to version 10.1.5. Upgrade version 10.2.0 to version 10.2.1.