Apache Traffic Server incorrectly parses a POST request that uses the Expect: 100-continue header when the origin server does not consume the request body. The server treats the unread body as a new HTTP request, which allows an attacker to smuggle a malicious request past a front‑end proxy and desynchronize subsequent responses. This issue is a CWE-444 vulnerability. This can lead to request smuggling vulnerabilities, denial of service, or injection of arbitrary requests into the tunnel.

The vulnerability is present in Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. Upgrading to 9.2.16, 10.1.5, or 10.2.1 removes the flaw.

The CVSS score of 7 indicates a high severity flaw, but the EPSS score is not available, so the current probability of exploitation is unknown. The vulnerability is not listed in CISA's KEV catalog, suggesting that no widespread known exploitation has been observed. Attackers would likely need a shared connection environment with a front‑end proxy that ignores the request body, which is a specific configuration but not uncommon in load‑balanced infrastructures. The likely attack vector involves leveraging a compromised or misconfigured front‑end proxy that shares the connection with Traffic Server; this inference is based on the description of smuggling requests through a shared connection. If exploited, the privilege of the attacker is limited to the traffic server process but the impact on application integrity and availability can be significant.