CVE-2025-55702High· 8.7▾ TwilightWhen a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy tha…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
0.3% → 0.3%
When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smuggle requests past the front end and desynchronize responses for other users.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
apache_traffic_server >= 8.0.0 <= 8.1.11apache_traffic_server >= 9.0.0 <= 9.2.15apache_traffic_server >= 10.0.0 <= 10.1.4apache_traffic_server 10.2.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111809Critical· 9.3Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling
CVE-2025-31699High· 8.9Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling
CVE-2026-111816Critical· 9.3Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out
CVE-2026-111805High· 8.6Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion
CVE-2026-111808High· 8.6Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion
CVE-2026-111815Critical· 10.0Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement