Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2025-31698

Apache Traffic Server: Client IP address from PROXY protocol is not used for ACL

Description

ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting (proxy.config.acl.subjects) to choose which IP addresses to use for the ACL if Apache Traffic Server is configured to accept PROXY protocol.  This issue affects undefined: from 10.0.0 through 10.0.6, from 9.0.0 through 9.2.10. Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Traffic Server

Default version status: unaffected

  • 10.0.0 to ≤ 10.0.6affected
  • 9.0.0 to ≤ 9.2.10affected

References