CVE-2025-61581highCWE-1333

CVE-2025-61581: falha de alta gravidade em Apache Traffic Control

Apache Traffic Control: ReDoS issue in Traffic Router configuration

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Apache Traffic Control+ Monitorar github.com/apache/trafficcontrol

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.7%
** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulnerability in Apache Traffic Control. This issue affects Apache Traffic Control: all versions. People with access to the management interface of the Traffic Router component could specify malicious patterns and cause unavailability. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Apache Software Foundation · Apache Traffic Control
CVEs relacionadas — Apache Traffic Control

No mesmo produto, das mais perigosas para as menos.

CVE-2024-45387CRITICALApache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_commentsEPSS 65.4%CVE-2021-43350—LDAP filter injection vulnerability in Traffic OpsEPSS 4.8%CVE-2017-7670—CVE-2017-7670EPSS 4.7%CVE-2021-42009—Apache Traffic Control Traffic Ops Email Injection VulnerabilityEPSS 2.8%CVE-2022-23206—Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauthEPSS 2.0%