Newly disclosed vulnerabilities in Apache Traffic Server could let attackers crash servers or manipulate web traffic without authentication.
Quick Summary – TLDR:
- Two high severity vulnerabilities found in Apache Traffic Server.
- Unauthenticated attackers can crash servers using simple POST requests.
- Second flaw enables HTTP request smuggling, risking data exposure.
- Immediate upgrades required as only partial workaround exists.
What Happened?
The Apache Software Foundation released security updates on April 2, 2026, addressing two critical flaws in Apache Traffic Server, a widely used enterprise proxy and caching system. The issues were discovered by security researchers Masakazu Kitajo and Katsutoshi Ikenoya, and both vulnerabilities stem from improper handling of HTTP request body data.
⚠️ **Vulnerability Alert:** Apache Traffic Server — Two high-severity DoS/request-smuggling vulnerabilities (CVE-2025-58136, CVE-2025-65114)
— Syed Aquib (@syedaquib77) April 6, 2026
📅 **Timeline:** Disclosure: 2026-04-02, Patch: 2026-04-02
🆔 **CVE-2025-58136** | 📊 CVSS: 7.5 (HIGH 🟠) | 📈 EPSS: 12.25%
🆔…
Details of the Vulnerabilities
The first vulnerability, tracked as CVE-2025-58136, exposes a serious flaw in how the server processes POST requests. Under specific conditions, sending a crafted request can force the server into an unrecoverable state, leading to a complete crash.
What makes this issue particularly dangerous is how easy it is to exploit:
- No authentication required
- No user interaction needed
- Low effort, high impact attack vector
This means any exposed server could be taken offline almost instantly, posing a direct threat to enterprise uptime and service availability.
HTTP Request Smuggling Threat
The second vulnerability, identified as CVE-2025-65114, involves improper parsing of chunked HTTP message bodies. This leads to inconsistencies in how requests are interpreted between the proxy and backend servers.
This flaw enables HTTP request smuggling, a sophisticated attack technique that can:
- Bypass security controls.
- Poison web caches.
- Intercept sensitive data from other users.
- Enable request and response manipulation.
Because this vulnerability affects how traffic is processed internally, it can be particularly difficult to detect once exploited.
Affected Versions and Risk Scope
The vulnerabilities impact multiple versions of Apache Traffic Server, including:
- 9.x branch from 9.0.0 to 9.2.12 or 9.2.13 depending on deployment.
- 10.x branch from 10.0.0 to 10.1.1.
Given that Apache Traffic Server is widely used in high traffic enterprise environments, the potential impact is significant, especially for systems exposed to untrusted networks.
Fixes and Mitigation Steps
Administrators are strongly advised to upgrade immediately:
- ATS 9.x users should update to version 9.1.13 or 9.2.13 or later
- ATS 10.x users should upgrade to 10.1.2 or newer
These versions fully address both vulnerabilities.
Temporary Workaround Available
For the DoS vulnerability (CVE-2025-58136), there is a partial mitigation:
- Set proxy.config.http.request_buffer_enabled to 0
This disables the vulnerable code path and prevents server crashes. Notably, this setting is already enabled by default in many deployments.
However, there is no workaround for the request smuggling issue. This makes upgrading critical for full protection.
Why This Matters for Enterprises?
Apache Traffic Server plays a central role in managing and caching web traffic for large scale applications. A flaw that allows attackers to both crash servers and silently manipulate requests creates a compounded security risk.
Even though there are no known active exploits reported yet, the simplicity of the DoS attack combined with the stealth of request smuggling makes this a high priority issue for security teams.
SQ Magazine’s Takeaway
I think this is one of those vulnerabilities that looks simple on the surface but carries serious consequences if ignored. A single request crashing a server is already bad, but pairing that with request smuggling makes it much more dangerous. If you are running Apache Traffic Server and delaying updates, you are basically leaving the door open. This is not something to postpone.
