This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Apache Traffic Server fixes 2 vulnerabilities
Apache versions 10.0.6 and 9.2.11 fix two vulnerabilities in Apache Traffic Server [1]. The fixed versions only provide configuration options to mitigate these vulnerabilities – their effectiveness depends on correct configuration by the user.
An unauthenticated remote attacker can perform a DoS attack due to a missing limit on the maximum inclusion depth in the ESI plugin [1][2]. The vulnerability can be mitigated by limiting the depth using the new setting '--max-inclusion-depth'.
The vulnerability is present in product:
- Apache Traffic Server; >=9.0.0, <=9.2.10; >=10.0.0, <=10.0.5;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-49763 at cve.org, NVD
- CWE-400: Uncontrolled Resource Consumption at cwe.mitre.org
The vulnerability was publicly disclosed 19. 6. 2025.
An unauthenticated remote attacker can gain unauthorized access due to incorrect handling of the client IP address when the server is configured in 'ip_allow.config' or 'remap.config' using the PROXY protocol [1][3]. The vulnerability can be mitigated using the new setting 'proxy.config.acl.subjects', which specifies the IP address to be used for evaluating ACL rules.
The vulnerability is present in product:
- Apache Traffic Server; >=9.0.0, <=9.2.10; >=10.0.0, <=10.0.5;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2025-31698 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 19. 6. 2025.
Links
By CESNET, z.s.p.o. Michaela Ručková on 20. 6. 2025.