How to fix EUVD-2025-18750?

Within 24 hours: Inventory all Apache Traffic Server deployments and identify which are configured with PROXY protocol and IP-based ACLs in ip_allow.config or remap.config. Within 7 days: Implement network segmentation to restrict traffic sources to Traffic Server and configure WAF rules to enforce IP allowlisting at an upstream layer. Within 30 days: Upgrade affected systems to version 9.2.11 or 10.0.6 or later, and validate ACL enforcement with security testing.

Is Traffic Server affected by EUVD-2025-18750?

Apache Traffic Server installations using PROXY protocol may bypass configured access control lists (ACLs), allowing unauthorized network traffic to reach protected resources.

EUVD-2025-18750

| CVE-2025-31698 HIGH

2025-06-19 [email protected]

7.5

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch Released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 15, 2026 - 00:08 vuln.today

EUVD ID Assigned

Mar 15, 2026 - 00:08 euvd

EUVD-2025-18750

CVE Published

Jun 19, 2025 - 10:15 nvd

HIGH 7.5

Description

ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting (proxy.config.acl.subjects) to choose which IP addresses to use for the ACL if Apache Traffic Server is configured to accept PROXY protocol. This issue affects undefined: from 10.0.0 through 10.0.6, from 9.0.0 through 9.2.10. Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.

Analysis

CVE-2025-31698 is a security vulnerability (CVSS 7.5). High severity vulnerability requiring prompt remediation.

Technical Context

CWE-284 (Improper Access Control). CVSS 7.5 indicates high severity.

Affected Products

['Unspecified product']

Remediation

Monitor vendor channels for patch availability.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.2

CVSS: +38

POC: 0

Vendor Status

Ubuntu

Priority: Medium

trafficserver

Release	Status	Version
xenial	needs-triage	-
bionic	needs-triage	-
focal	needs-triage	-
oracular	ignored	end of life, was needs-triage
plucky	ignored	end of life, was needs-triage
jammy	needed	-
noble	needed	-
upstream	released	9.2.11
questing	needed	-

Debian

Bug #1108044

trafficserver

Release	Status	Fixed Version	Urgency
bullseye	vulnerable	8.1.10+ds-1~deb11u1	-
bullseye (security)	vulnerable	8.1.11+ds-0+deb11u2	-
bookworm, bookworm (security)	fixed	9.2.5+ds-0+deb12u3	-
sid	vulnerable	9.2.5+ds-1	-
bookworm	fixed	9.2.5+ds-0+deb12u3	-
(unstable)	fixed	(unfixed)	-

DSA-5948-1

EUVD-2025-18750 vulnerability details – vuln.today

Back

EUVD-2025-18750

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Vendor Status

Ubuntu

Debian

Share

EUVD-2025-18750

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Vendor Status

Ubuntu

Debian

Share

External POC / Exploit Code