CVE-2025-55702 Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2025-55702?
CVE-2025-55702 is a high-severity vulnerability in Apache Traffic Server, published on 21 Oct 2026.
Official description
When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smuggle requests past the front end and desynchronize responses for other users.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Weakness: CWE-444
Which versions are affected by CVE-2025-55702?
How do I fix CVE-2025-55702?
No fix has been published for CVE-2025-55702 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-55702 being exploited?
There is no known exploitation of CVE-2025-55702 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-55702, GHSA-5vqp-jf47-frjg, UBUNTU-CVE-2025-55702.