CVE-2025-31699

Summary

Apache Traffic Server incorrectly returns backend connections to the shared pool before fully consuming the client's declared request body, allowing an attacker to smuggle subsequent requests through that connection, bypassing access controls and potentially poisoning caches.

Exploitability

Exploitation requires precise timing and control over the HTTP request stream; the attacker must send a partial request body while declaring a larger one (e.g., via Expect: 100-continue) and immediately follow with a second request on the same connection before the origin consumes the leftover data.

Blast radius

Successful exploitation could let an unauthenticated attacker bypass access controls, disrupt legitimate users' requests, or inject malicious content into the cache, affecting all downstream clients served via the compromised connection.

Detection

Look for abnormal HTTP/1.1 request sequences on backend connections where a subsequent request appears immediately after an incomplete request body, especially with mismatched Content-Length or Expect headers; such patterns may appear in ATS access logs or origin server logs as unexpected request framing anomalies.

Prioritized remediation

Upgrade to Apache Traffic Server version 9.2.16, 10.1.5, or 10.2.1, which contain the fix for this issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.