CVE-2025-61581 Apache Traffic Control: ReDoS issue in Traffic Router configuration
Attackers with management access can cause denial of service via malicious regex patterns in Apache Traffic Control, which is now retired.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-61581?
CVE-2025-61581 is a high-severity denial of service vulnerability in Apache Traffic Control, published on 16 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulnerability in Apache Traffic Control.
This issue affects Apache Traffic Control: all versions.
People with access to the management interface of the Traffic Router component could specify malicious patterns and cause unavailability.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Weakness: CWE-1333
Which versions are affected by CVE-2025-61581?
4 open source packages ship an affected version, including github.com/apache/trafficcontrol/v8 and github.com/apache/trafficcontrol. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/apache/trafficcontrol/v8 Go | All versions | None |
github.com/apache/trafficcontrol/v8 Go | All versions to 8.0.2 | None |
github.com/apache/trafficcontrol/v8 Go | All versions to 8.0.2 | None |
github.com/apache/trafficcontrol Go | All versions | None |
Products include Apache Traffic Control.
How do I fix CVE-2025-61581?
Product is end of life, replace it.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-61581 being exploited?
There is no known exploitation of CVE-2025-61581 in the wild and no public exploit code.
Other vulnerabilities in Apache Traffic Control
- CVE-2024-45387 Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments
- CVE-2021-43350 LDAP filter injection vulnerability in Traffic Ops
- CVE-2019-12405 Improper Authentication in Apache Traffic Control
- CVE-2022-23206 Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth
- CVE-2017-7670 Apache Traffic Control vulnerable to Slowloris-style Denial of Service attack
Sources
Also known as GHSA-9m49-p2j3-c6xm, GO-2025-4033.