CVE-2025-61581— Apache Traffic Control: ReDoS issue in Traffic Router configuration
Quick assessment
Affected
Apache Software Foundation Apache Traffic Control
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Traffic Control是美国阿帕奇（Apache）基金会的一套分布式、可扩展的内容分发解决方案。该产品主要用于构建大规模内容分发网络。 Apache Traffic Control存在安全漏洞，该漏洞源于管理界面中可指定恶意模式，可能导致正则表达式拒绝服务。
Possible ATT&CK Techniques 1 AI
T1496 · Resource Hijacking
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-61581
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Traffic Control: ReDoS issue in Traffic Router configuration
Source: CVE Program / CVE List V5
Vulnerability Description
** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulnerability in Apache Traffic Control.
This issue affects Apache Traffic Control: all versions.
People with access to the management interface of the Traffic Router component could specify malicious patterns and cause unavailability.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1333
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Traffic Control 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Traffic Control是美国阿帕奇（Apache）基金会的一套分布式、可扩展的内容分发解决方案。该产品主要用于构建大规模内容分发网络。 Apache Traffic Control存在安全漏洞，该漏洞源于管理界面中可指定恶意模式，可能导致正则表达式拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Traffic Control | 0 ~ * | - |
|
II. Public POCs for CVE-2025-61581
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-61581
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Apache Traffic Control
-
CVE-2024-45387
Apache Traffic Control: SQL Injection in Traffic Ops endpoin -
CVE-2022-23206
Server-Side Request Forgery in Traffic Ops endpoint POST /us -
CVE-2021-43350
LDAP filter injection vulnerability in Traffic Ops -
CVE-2021-42009
Apache Traffic Control Traffic Ops Email Injection Vulnerabi -
CVE-2020-17522
Apache Traffic Control 安全漏洞
Same vendor: Apache Software Foundation
-
CVE-2026-102795
Apache Traffic Server: SNI to Host header matching policy is -
CVE-2026-59265
Apache OpenOffice, Apache OpenOffice: Opening a malicious do -
CVE-2026-66054
Apache Thrift: C++ THeaderTransport does not enforce configu -
CVE-2026-61374
Apache Thrift: Java TSaslTransport post-auth data-frame miss -
CVE-2026-63772
Apache Thrift: Unauthenticated single-packet crash of Go Thr
Same weakness: CWE-1333
-
CVE-2026-104454
YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoi -
CVE-2026-96292
Apache Thrift: Lua `THttpTransport:_parseHeaders` matches ea -
CVE-2026-77387
geopy: Regular Expression Denial of Service (ReDoS) in geopy -
CVE-2026-102990
basic-ftp: Quadratic-time CPU denial of service in Client.li -
CVE-2026-100267
JetBrains YouTrack 2026.2前邮箱正则拒绝服务漏洞
V. Comments for CVE-2025-61581
No comments yet