Cyber Resilience

CVE-2025-65114

High

Published: 02 April 2026

Published
02 April 2026
Modified
06 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0031 54.7th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-65114 is a high-severity HTTP Request/Response Smuggling (CWE-444) vulnerability in Apache Traffic Server. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 45.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-65114 is a vulnerability in Apache Traffic Server that enables HTTP request smuggling when chunked messages are malformed. The issue affects Apache Traffic Server versions from 9.0.0 through 9.2.12 and from 10.0.0 through 10.1.1. It is classified under CWE-444 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), highlighting its potential for network-based integrity violations.

Unauthenticated remote attackers with network access to a vulnerable Apache Traffic Server instance can exploit this flaw with low complexity and no user interaction required. By sending specially crafted malformed chunked requests, attackers can perform HTTP request smuggling, achieving high integrity impact such as interfering with request processing or routing.

The Apache advisory, detailed in the mailing list thread at https://lists.apache.org/thread/2s11roxlv1j8ph6q52rqo1klvl01n14q, recommends upgrading to remedied versions 9.2.13 or 10.1.2 to mitigate the vulnerability.

EU & UK References

Vulnerability details

Apache Traffic Server allows request smuggling if chunked messages are malformed.  This issue affects Apache Traffic Server: from 9.0.0 through 9.2.12, from 10.0.0 through 10.1.1. Users are recommended to upgrade to version 9.2.13 or 10.1.2, which fix the issue.

CWE(s)
CWE-444

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Direct remote exploitation of public-facing Apache Traffic Server proxy via malformed HTTP chunked requests enabling request smuggling.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-58136Same product: Apache Traffic Server
CVE-2026-41873Same vendor: Apache
CVE-2026-24880Same vendor: Apache
CVE-2026-46586Same vendor: Apache
CVE-2025-24783Same vendor: Apache
CVE-2024-53678Same vendor: Apache
CVE-2026-34059Same vendor: Apache
CVE-2026-40961Same vendor: Apache
CVE-2025-48913Same vendor: Apache
CVE-2026-27446Same vendor: Apache

Affected Assets

apache
traffic server
9.0.0 — 9.2.13 · 10.0.0 — 10.1.2

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates CVE-2025-65114 by requiring timely patching of the Apache Traffic Server flaw in malformed chunked message handling.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Enables detection of CVE-2025-65114 through vulnerability scanning of Apache Traffic Server instances.

SI-10 Information Input Validation partial match
prevent

Validates incoming HTTP requests to reject malformed chunked messages that exploit the request smuggling vulnerability.

References