PT-2025-42447 · Apache · Apache Traffic Control

Chris Lemmons · Published 2025-10-16 · Updated 2025-11-07 · CVE-2025-61581

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Traffic Control (affected versions not specified)

Description A flaw exists in Apache Traffic Control’s Traffic Router component where a malicious pattern provided through the management interface can lead to unavailability. Individuals with access to the management interface are able to specify these patterns. This project is no longer supported, and a fix will not be released.

Recommendations Restrict access to the instance to trusted users. Find an alternative to Apache Traffic Control.

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2025-61581

GHSA-9M49-P2J3-C6XM

GO-2025-4033

OPENSUSE-SU-2025:15710-1

Affected Products

Apache Traffic Control

References · 87

• https://lists.apache.org/thread/mx2jxgnlop2f4vbqnvmrldh4pqmobxvp · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9m49-p2j3-c6xm · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15710-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4033 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-61581 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61581 · Security Note
• https://github.com/apache/trafficcontrol · Note
• https://suse.com/security/cve/CVE-2025-58073 · Note
• https://suse.com/security/cve/CVE-2016-11067 · Note
• https://suse.com/security/cve/CVE-2016-11078 · Note
• https://suse.com/security/cve/CVE-2025-59043 · Note
• https://t.me/cveNotify/139409 · Telegram Post
• https://suse.com/security/cve/CVE-2025-11375 · Note
• https://suse.com/security/cve/CVE-2025-54471 · Note
• https://suse.com/security/cve/CVE-2016-11077 · Note