CVE-2025-55702
Description
When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smuggle requests past the front end and desynchronize responses for other users. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Software Foundation Apache Traffic Server | 8.0.0 ≤ v ≤ 8.1.11, 9.0.0 ≤ v ≤ 9.2.15, 10.0.0 ≤ v ≤ 10.1.4, 10.2.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.