CVE-2025-61581

CVE-2025-61581: Apache Traffic Control: ReDoS issue in Traffic Router configuration

Vendor Apache Software Foundation
Product Apache Traffic Control
Weakness CWE-1333
Published October 16, 2025
Last update November 4, 2025

CVSS base score

What the vulnerability does

Description

** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulnerability in Apache Traffic Control. This issue affects Apache Traffic Control: all versions. People with access to the management interface of the Traffic Router component could specify malicious patterns and cause unavailability. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Key dates

Disclosure timeline

October 16, 2025 CVE published
November 4, 2025 Record updated