CVE-2025-65114
Published: 02 April 2026
Summary
CVE-2025-65114 is a high-severity HTTP Request/Response Smuggling (CWE-444) vulnerability in Apache Traffic Server. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2025-65114 by requiring timely patching of the Apache Traffic Server flaw in malformed chunked message handling.
Enables detection of CVE-2025-65114 through vulnerability scanning of Apache Traffic Server instances.
Validates incoming HTTP requests to reject malformed chunked messages that exploit the request smuggling vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of public-facing Apache Traffic Server proxy via malformed HTTP chunked requests enabling request smuggling.
NVD Description
Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.12, from 10.0.0 through 10.1.1. Users are recommended to upgrade to version 9.2.13 or 10.1.2, which fix the issue.
Deeper analysisAI
CVE-2025-65114 is a vulnerability in Apache Traffic Server that enables HTTP request smuggling when chunked messages are malformed. The issue affects Apache Traffic Server versions from 9.0.0 through 9.2.12 and from 10.0.0 through 10.1.1. It is classified under CWE-444 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), highlighting its potential for network-based integrity violations.
Unauthenticated remote attackers with network access to a vulnerable Apache Traffic Server instance can exploit this flaw with low complexity and no user interaction required. By sending specially crafted malformed chunked requests, attackers can perform HTTP request smuggling, achieving high integrity impact such as interfering with request processing or routing.
The Apache advisory, detailed in the mailing list thread at https://lists.apache.org/thread/2s11roxlv1j8ph6q52rqo1klvl01n14q, recommends upgrading to remedied versions 9.2.13 or 10.1.2 to mitigate the vulnerability.
Details
- CWE(s)