CVE-2025-49763

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-49763
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10. Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/15t32nxbypqg1m2smp640vjx89o6v5f8 Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
History

01 Jul 2025, 20:15

Type Values Removed Values Added
CPE cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
References () https://lists.apache.org/thread/15t32nxbypqg1m2smp640vjx89o6v5f8 - () https://lists.apache.org/thread/15t32nxbypqg1m2smp640vjx89o6v5f8 - Mailing List, Vendor Advisory
First Time Apache
Apache traffic Server

20 Jun 2025, 14:15

Type Values Removed Values Added
Summary
  • (es) El complemento ESI no tiene límite de profundidad máxima de inclusión, lo que permite un consumo excesivo de memoria si se insertan instrucciones maliciosas. Los usuarios pueden usar una nueva configuración del complemento (--max-inclusion-depth) para limitarlo. Este problema afecta a Apache Traffic Server: de la 10.0.0 a la 10.0.5 y de la 9.0.0 a la 9.2.10. Se recomienda actualizar a la versión 9.2.11 o 10.0.6, que soluciona el problema.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

19 Jun 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-19 10:15

Updated : 2025-07-01 20:15

NVD link : CVE-2025-49763

Mitre link : CVE-2025-49763

CVE.ORG link : CVE-2025-49763

JSON object : View

Products Affected

apache

  • traffic_server
CWE
CWE-400

Uncontrolled Resource Consumption