CVE-2025-55702: CWE-444 Inconsistent Interpretation of HTTP Requests in Apache Software Foundation Apache Traffic Server

Apache Traffic Server improperly handles HTTP POST requests with the Expect: 100-continue header when the origin server responds before reading the request body. In this scenario, Traffic Server treats the unread request body left on the client connection as a subsequent HTTP request. This behavior allows an attacker positioned behind a front-end proxy that shares connections to Traffic Server to perform HTTP request smuggling, bypassing front-end controls and causing response desynchronization affecting other users. The vulnerability affects multiple version ranges of Apache Traffic Server and is addressed in versions 9.2.16, 10.1.5, and 10.2.1.

Successful exploitation can lead to HTTP request smuggling attacks, allowing an attacker to bypass front-end proxy controls and cause response desynchronization for other users. This can result in unauthorized request execution and potential compromise of confidentiality and integrity of HTTP communications. The CVSS score of 8.7 reflects high impact on confidentiality and integrity with network attack vector and no privileges required.

Users should upgrade Apache Traffic Server to versions 9.2.16, 10.1.5, or 10.2.1 or later, which contain official fixes for this vulnerability. No other mitigations are specified by the vendor advisory. Patch status is confirmed as fixed in these versions.