PT-2026-29793 · Apache · Apache Traffic Server

Katsutoshi Ikenoya · Published 2026-04-02 · Updated 2026-05-22 · CVE-2025-65114

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 9.0.0 through 9.2.12 and 10.0.0 through 10.1.1

Description Apache Traffic Server is susceptible to request smuggling when handling malformed chunked messages. This can potentially lead to various security issues.

Recommendations Upgrade to version 9.2.13 or 10.1.2.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2025-65114

OESA-2026-2383

OESA-2026-2385

Affected Products

Apache Traffic Server

References · 18

• https://lists.apache.org/thread/2s11roxlv1j8ph6q52rqo1klvl01n14q · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-65114 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-65114 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2383 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-65114 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58136 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-65114 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-65114 · Security Note
• https://ubuntu.com/security/CVE-2025-65114 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2385 · Vendor Advisory
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2385 · Note
• https://twitter.com/syedaquib77/status/2041125709213573352 · Twitter Post
• https://twitter.com/syedaquib77/status/2041132540505776183 · Twitter Post
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2383 · Note
• https://twitter.com/the_yellow_fall/status/2040085665568690476 · Twitter Post