EUVD-2025-209188
GHSA-wvq7-4f7c-q7wc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (apache) · only source for this CVE.
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
A bug in POST request handling causes a crash under a certain condition.
This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12.
Users are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue.
A workaround for older versions is to set proxy.config.http.request_buffer_enabled to 0 (the default value is 0).
AnalysisAI
Denial of service in Apache Traffic Server 9.0.0-9.2.12 and 10.0.0-10.1.1 caused by improper handling of POST requests that triggers a server crash under specific conditions. The vulnerability affects all instances of the affected versions and requires no authentication or special privileges to exploit. Vendor-released patches are available in versions 9.2.13 and 10.1.2.
Technical ContextAI
Apache Traffic Server is a high-performance, open-source HTTP proxy and caching server. The vulnerability resides in the POST request handling logic (CWE-670: Improper Handling of Incomplete Data or Missing Data), indicating a defect in how the server processes or validates HTTP POST message frames or request bodies during parsing. The affected versions span two major release branches (9.x and 10.x), suggesting the bug may have been introduced or persisted across refactored code paths. The workaround-disabling request buffering via proxy.config.http.request_buffer_enabled-implies the crash occurs within the request buffering subsystem when processing POST data under edge-case conditions (e.g., malformed body, unusual Content-Length values, or chunked encoding anomalies).
RemediationAI
Vendor-released patches: upgrade Apache Traffic Server to version 9.2.13 or 10.1.2, depending on the currently deployed branch. For versions that cannot be immediately patched, apply the workaround by setting proxy.config.http.request_buffer_enabled to 0 in the proxy configuration file (note that this is the default value, so the issue likely manifests only under non-default configurations). Consult the vendor advisory at https://lists.apache.org/thread/2s11roxlv1j8ph6q52rqo1klvl01n14q for detailed upgrade and configuration instructions.
More in Apache Traffic Server
View allRemote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy
Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows rem
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-b
Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers t
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today