Apache Traffic Control (Apache Software Foundation) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2025-10-16. Vendor: Apache Software Foundation.

CVEs of Apache Traffic Control

• CVE-2025-61581 - CVSS 7.5 (high), 2025-10-16: ** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulnerability in Apache Traffic Control. This issue affects Apache Traffic Control:…
• CVE-2024-45387 - CVSS 9.9 (critical), 2024-12-23: An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation",…
• CVE-2022-23206 - CVSS 7.5 (high), 2022-02-06: In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST…
• CVE-2021-43350 - CVSS 9.8 (critical), 2021-11-11: An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version…
• CVE-2021-42009 - CVSS 4.3 (medium), 2021-10-12: An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the…
• CVE-2017-7670 - CVSS 7.5 (high), 2017-07-10: The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections…