CVE-2025-61581highCWE-1333

CVE-2025-61581: fallo de gravedad alta en Apache Traffic Control

Apache Traffic Control: ReDoS issue in Traffic Router configuration

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Apache Traffic Control+ Monitorear github.com/apache/trafficcontrol

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.7%
** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulnerability in Apache Traffic Control. This issue affects Apache Traffic Control: all versions. People with access to the management interface of the Traffic Router component could specify malicious patterns and cause unavailability. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
Apache Software Foundation · Apache Traffic Control
CVEs relacionadas — Apache Traffic Control

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-45387CRITICALApache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_commentsEPSS 66.1%CVE-2021-43350—LDAP filter injection vulnerability in Traffic OpsEPSS 4.8%CVE-2017-7670—CVE-2017-7670EPSS 4.7%CVE-2021-42009—Apache Traffic Control Traffic Ops Email Injection VulnerabilityEPSS 2.8%CVE-2022-23206—Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauthEPSS 2.0%