CVE-2025-49763

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-49763
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-49763.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-49763
Downstream
Published
2025-06-19T10:07:15.450Z
Modified
2026-07-01T11:54:03.051999797Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Apache Traffic Server: Remote DoS via memory exhaustion in ESI Plugin
Details

ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted.

Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10.

Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "10.0.0"
                },
                {
                    "last_affected": "10.0.5"
                },
                {
                    "introduced": "9.0.0"
                },
                {
                    "last_affected": "9.2.10"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "10.0.0"
                },
                {
                    "fixed": "10.0.5"
                },
                {
                    "introduced": "9.0.0"
                },
                {
                    "fixed": "9.2.10"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49763.json",
    "cna_assigner": "apache"
}
References

Affected packages

Git / github.com/apache/trafficserver

Affected ranges

Type
GIT
Repo
https://github.com/apache/trafficserver
Events
Introduced
b14030656330ed623cd1f9efe2f4f9abd9d16e29
Fixed
fdf5fb223c5eef92991ceb28a53cb8add956914b
Introduced
3fa146678bc6a061722f4ea930998ae29ad70de3
Fixed
34d1de7ecb07be7a61309fd92688910537b66b9a
Database specific 
{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.2.11"
        },
        {
            "introduced": "10.0.0"
        },
        {
            "fixed": "10.0.6"
        }
    ],
    "cpe": "cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*"
}

Affected versions

10.*
10.0.0
10.0.0-rc0
10.0.1
10.0.1-rc0
10.0.1-rc1
10.0.2
10.0.2-rc0
10.0.3
10.0.3-rc0
10.0.3-rc1
10.0.4
10.0.4-rc0
10.0.5
10.0.5-rc0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-49763.json"