CVE-2025-55702
Description
A flaw was found in Apache Traffic Server. When a client sends a POST request with an Expect header and the origin server responds before consuming the full body, Traffic Server incorrectly parses the remaining unread body as a subsequent request. A remote attacker behind a front-end proxy sharing connections can exploit this issue to perform HTTP request smuggling, enabling them to bypass front-end security boundaries and access or tamper with responses intended for other users.
Statement
This vulnerability is rated as having an Important severity because successful exploitation permits an unauthenticated remote attacker to compromise the integrity and confidentiality of web traffic across multiplexed connections without requiring prior privileges. In shared proxy environments, desynchronization between upstream servers and intermediate caching layers can enable arbitrary request pipelining and cross-user data interception. Apache Traffic Server is not included in core Red Hat Enterprise Linux distributions and is only shipped via Fedora and Extra Packages for Enterprise Linux (EPEL).
Understanding the Weakness (CWE)
Integrity,Non-Repudiation,Access Control
Technical Impact: Unexpected State; Hide Activities; Bypass Protection Mechanism
An attacker could create HTTP messages to exploit a number of weaknesses including 1) the message can trick the web server to associate a URL with another URL's webpage and caching the contents of the webpage (web cache poisoning attack), 2) the message can be structured to bypass the firewall protection mechanisms and gain unauthorized access to a web application, and 3) the message can invoke a script or a page that returns client credentials (similar to a Cross Site Scripting attack).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
