CVE-2025-31699

The record

Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

Affected packages

Related vulnerabilities

• CVE-2026-55613 uhttpd is a small HTTP server. CWE-444
• CVE-2026-55614 uhttpd is a small HTTP server. CWE-444
• CVE-2026-55612 uhttpd is a small HTTP server. CWE-444
• CVE-2026-116127 Starlet versions before 0.33 for Perl send a body in responses to HEAD requests… CWE-444
• CVE-2026-91920 A flaw was found in the ChunkReader component of the Undertow web server, which is used… CWE-444
• CVE-2026-118264 Echo is a Go web framework. CWE-444
• CVE-2026-103995 Response body and chunk parsing would handle non-hex or negative integers incorrectly… CWE-444
• CVE-2026-115823 Starman versions before 0.4019 for Perl send response bodies for HEAD requests… CWE-444