Apache Traffic Server EUVD-2025-211167

Exploitation requires the client to declare a request body that it never fully sends - specifically Content-Length- or Expect: 100-continue-based bodies - so that ATS returns the origin connection to its shared keep-alive pool while the body is still outstanding; this is the default behavior of ATS origin connection pooling, requiring no special non-default configuration. No authentication is required (PR:N) and the attack is remote (AV:N). The key limiting factor is timing: per AT:P, the attacker must hit the window in which the half-finished request's connection is recycled and reused for a later request, which makes reliable exploitation probabilistic rather than guaranteed. Affected deployments are ATS 8.0.0-8.1.11, 9.0.0-9.2.15, 10.0.0-10.1.4, and 10.2.0.

This is a genuine high-priority issue, not merely a high-CVSS paper risk. The vendor-assigned CVSS 4.0 vector (9.1) shows network attack vector, low complexity, no privileges and no user interaction (AV:N/PR:N/UI:N), with high integrity impact to both the vulnerable and subsequent systems (VI:H/SI:H) and a scope change (SC:H) - consistent with CWE-444 HTTP request smuggling that crosses the proxy/origin trust boundary. The one mitigating signal in the vector is AT:P (a specific attack requirement), reflecting that exploitation depends on a timing/protocol condition (the client declaring a body it never finishes sending, e.g. via Expect: 100-continue) and on an origin keep-alive connection being recycled into the shared pool at the wrong moment. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no evidence of active exploitation or weaponized exploit code at this time; the realistic risk is driven by the class of bug (request smuggling against a reverse proxy is historically high-value for access-control bypass and cache poisoning) rather than by observed in-the-wild activity. Net: patch promptly given the unauthenticated network reach and access-control/cache-poisoning consequences, while noting exploitation is probabilistic due to the required race condition.

A remote unauthenticated attacker sends a request through ATS declaring a body (for example using Expect: 100-continue) but never fully transmits it; ATS prematurely returns the origin connection to the shared pool, and the attacker's or another user's subsequent request on that reused connection is misinterpreted by the origin as leftover body data. This lets the attacker smuggle a request past ATS access controls, hijack or disrupt another user's request, or poison the shared cache. No public exploit code was identified at time of analysis, and success depends on winning the connection-reuse timing window.