High severity · published Oct 16, 2025
CVE-2025-61581
Apache Traffic Control: ReDoS issue in Traffic Router configuration
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulnerability in Apache Traffic Control. This issue affects Apache Traffic Control: all versions. People with access to the management interface of the Traffic Router component could specify malicious patterns and cause unavailability. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TC
Traffic Control · Apache
through 8.0.2 · source: NVD
Affected product
AT
Apache Traffic Control
Apache Software Foundation
More from Apache Traffic Control
8.8
CVE-2024-45387
Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments