Apache Traffic Server may return an origin connection to its shared pool while the origin is still waiting for a request body that the client declared but never fully transmitted, such as when the client employs an Expect: 100-continue header. The remaining body data is then interpreted as part of a later request on the same connection, allowing an attacker to smuggle HTTP requests past ATS access controls, disrupt legitimate traffic, or poison the cache.

Affected versions of the Apache Traffic Server product include all releases from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and the single release 10.2.0. Administrators should note that version 10.2.1 and later, 10.1.5 and later, and 9.2.16 and later contain the fix for this problem.

The CVSS score of 9.1 signals high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves a client sending a request that declares a body but sends only part of it, often with an Expect: 100-continue header, and then immediately issuing a second request on the same connection. The origin, having returned the connection to the pool, interprets the bytes of the second request as leftover data from the incomplete body, thereby smuggling the request through ATS. This inference is derived from the description that the origin reads a later request on the same connection as leftover body data.