Non évaluée
Apache Traffic Server: Remote DoS via memory exhaustion in ESI Plugin
CVE-2025-49763
Première détection SecPulse
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2025-49763 trafficserver
Description d'origine La description telle que publiée par la source (souvent en anglais).
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted.
Users can use a new setting for the plugin (--max-inclusion-depth) to limit it.
This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10.
Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.
Références
- advisory github.com
- advisory lists.apache.org
- advisory nvd.nist.gov