High severity · published Oct 16, 2025
CVE-2025-61581
Apache Traffic Control: ReDoS issue in Traffic Router configuration
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulnerability in Apache Traffic Control.
This issue affects Apache Traffic Control: all versions.
People with access to the management interface of the Traffic Router component could specify malicious patterns and cause unavailability.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
Apache Traffic Control · Apache Software Foundation
0 · source: vendor
TC
Traffic Control · Apache
through 8.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-61581
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-61581
Mailing List
https://lists.apache.org/thread/mx2jxgnlop2f4vbqnvmrldh4pqmobxvp
www.openwall.com
http://www.openwall.com/lists/oss-security/2025/10/16/3
More from Apache Traffic Control
8.8
CVE-2024-45387
Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments
