Apache Traffic Server EUVD-2025-211168

Exploitation requires Apache Traffic Server to be deployed BEHIND a front-end proxy that shares/pools and reuses its upstream connections to ATS (a multi-tenant edge or CDN topology) - this is the AT:P attack requirement and is the primary limiting factor. The concrete trigger is a client POST carrying the 'Expect: 100-continue' header where the origin answers before the request body is read, leaving the body unconsumed on the client connection for ATS to misparse as the next request. No authentication is required (PR:N) and no user interaction (UI:N), but standalone ATS deployments or those not fronted by a connection-reusing proxy are NOT exploitable, which substantially narrows real-world exposure despite the network attack vector.

This is a genuine, well-characterized HTTP request smuggling flaw (CWE-444) in Apache Traffic Server, confirmed and reported by the Apache Software Foundation itself, with affected ranges and fixed versions published in an official lists.apache.org advisory. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 7.0 (High): network-reachable and unauthenticated, but carrying AT:P (attack requirements present), reflecting that exploitation depends on a specific deployment topology - ATS sitting behind a connection-sharing front-end proxy. Critically, VC:N/VI:N/VA:N but SC:H/SI:H: the ATS node itself is not directly compromised; the real damage is to SUBSEQUENT systems/users (response desynchronization, request smuggling past the front end, potential cache poisoning or cross-user response leakage). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a credible, moderately-high priority for organizations running ATS in a shared-front-end/CDN topology, but materially lower risk for standalone or direct-to-origin ATS deployments because the AT:P condition (shared pooled connections) is not met. Prioritize patching on multi-tenant/proxy-fronted edge tiers; treat as routine elsewhere.

An attacker, as an ordinary client behind a front-end proxy that pools and reuses its connections to Apache Traffic Server, sends a POST request with an 'Expect: 100-continue' header; the origin responds before the request body is read, leaving the unread body on the shared connection. ATS then parses that leftover body as the start of the next request, letting the attacker smuggle a crafted request past the front end and desynchronize responses so another user receives attacker-influenced or mismatched responses. No public exploit code was identified at time of analysis, and the attack requires the specific shared-connection topology (CVSS AT:P), raising complexity beyond a trivial single-request exploit.