PT-2025-25773 · Apache+1 · Apache Traffic Server+1

Yohann Sillam · Published 2025-01-01 · Updated 2026-01-09 · CVE-2025-49763

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 9.0.0 through 9.2.10 Apache Traffic Server versions 10.0.0 through 10.0.5

Description The issue allows excessive memory consumption if malicious instructions are inserted due to the lack of a limit for maximum inclusion depth in the ESI plugin. This can be exploited, potentially leading to significant issues. Users can utilize a new setting for the plugin (--max-inclusion-depth) to limit the inclusion depth.

Recommendations For Apache Traffic Server versions 9.0.0 through 9.2.10, upgrade to version 9.2.11. For Apache Traffic Server versions 10.0.0 through 10.0.5, upgrade to version 10.0.6.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-49763

DSA-5948-1

OESA-2025-1731

OESA-2025-1732

OESA-2025-1904

OESA-2026-1019

Affected Products

Apache Traffic Server

Debian

References · 36

• https://nvd.nist.gov/vuln/detail/CVE-2024-50305 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-38479 · Security Note
• https://ubuntu.com/security/CVE-2025-49763 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-49763 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-49763 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-49763 · Vendor Advisory
• https://lists.apache.org/thread/15t32nxbypqg1m2smp640vjx89o6v5f8 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-49763 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1904 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-31698 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-49763 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1019 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1731 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-49763 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1732 · Vendor Advisory