Apache Traffic Server EUVD-2025-209190

Although CVSS and EPSS scores are not available, request smuggling vulnerabilities historically present severe real-world risk due to their ability to bypass security controls, poison caches, and enable session fixation or credential theft. The vulnerability affects a core parsing function (chunked message handling) that processes every HTTP request in vulnerable versions, making it difficult to isolate without code-level mitigations. The attack vector is remote and requires no authentication (implied by the smuggling mechanism-an attacker sends a single malicious request). However, exploitation complexity depends on backend server behavior and request routing logic, meaning not all deployments may be equally exposed. The fact that Apache released fixes for two major version lines (9.x and 10.x) suggests internal severity assessment was significant. Priority should be HIGH for any organization using Traffic Server as a reverse proxy or load balancer facing untrusted networks.

An attacker sends a single HTTP request with a malformed chunked encoding to a Traffic Server instance. Traffic Server misparsees the chunk boundaries, while the backend server (e.g., Apache, Nginx, application server) interprets the same request differently, causing it to accept two distinct logical requests. The attacker crafts the payload so that the second smuggled request (e.g., GET /admin/bypass) bypasses authentication or authorization checks enforced by a WAF, load balancer, or reverse proxy rule, gaining unauthorized access or modifying server state. No public exploit code has been identified, but the attack requires only basic HTTP crafting knowledge and a vulnerable Traffic Server instance reachable from the attacker's network.