CVE-2025-31698CWE-284

Apache Traffic Server: Client IP address from PROXY protocol is not used for ACL

High · published June 19, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
45.5
In the wild
Unconfirmed
What it is

ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol.

Users can use a new setting (proxy.config.acl.subjects) to choose which IP addresses to use for the ACL if Apache Traffic Server is configured to accept PROXY protocol.

This issue affects undefined: from 10.0.0 through 10.0.6, from 9.0.0 through 9.2.10.

Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00553 · 45.5th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-06-19T10:07Z
EPSS history
Timeline
  • 19 JUN 10:07Z
    Apache Traffic Server: Client IP address from PROXY protocol is not used for ACL
    cvelistv5