Unrated
Apache Traffic Server: Remote DoS via memory exhaustion in ESI Plugin
CVE-2025-49763
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-49763 trafficserver
Original description The description as published by the source.
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted.
Users can use a new setting for the plugin (--max-inclusion-depth) to limit it.
This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10.
Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.
References
- advisory github.com
- advisory lists.apache.org
- advisory nvd.nist.gov