CVE-2025-65114 in Traffic Server
Summary
Apache Traffic Server allows request smuggling if chunked messages are malformed.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.12, from 10.0.0 through 10.1.1.
Users are recommended to upgrade to version 9.2.13 or 10.1.2, which fix the issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Responsible
apache
Reservation
11/18/2025
Disclosure
04/02/2026
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 354930 | Apache Traffic Server Chunked Message request smuggling | 444 | Not defined | Official fix | CVE-2025-65114 |