CVE-2025-31699
Description
A flaw was found in Apache Traffic Server. An unauthenticated remote attacker can send a request with an incomplete body, causing an origin connection to be prematurely returned to the shared pool while the backend is still awaiting data. When a subsequent request is processed over that reused connection, the backend interprets it as leftover body data. This allows the attacker to perform HTTP request smuggling to bypass access controls, poison shared web caches, or disrupt other users' traffic.
Statement
This vulnerability is rated as Important severity because an unauthenticated remote attacker can leverage HTTP request smuggling to circumvent proxy security boundaries, corrupt cache entries, or disrupt communications between clients and origin servers. The issue stems from premature backend connection reuse when declared client request payloads are left incomplete. However, Apache Traffic Server is not distributed or supported as a standard component in Red Hat Enterprise Linux, minimizing direct exposure across supported environments.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
