FlagThis - #dos

A critical security vulnerability, CVE-2025-49763, has been identified in Apache Traffic Server (ATS). This flaw, discovered by Imperva's Offensive Security Team, resides within the ESI plugin of ATS and can be exploited by remote, unauthenticated attackers to trigger denial-of-service (DoS) attacks. The vulnerability stems from the potential for attackers to initiate an "avalanche" of internal ESI requests, leading to the exhaustion of server memory. The CVSS v3.1 score is estimated at 7.5, classifying it as a high-severity issue.

The memory exhaustion vulnerability allows malicious actors to potentially crash proxy nodes within the Apache Traffic Server infrastructure. To mitigate the risk posed by CVE-2025-49763, security experts advise upgrading ATS to the latest version and carefully configuring Access Control List (ACL) settings. Specifically, administrators should define limits for the ESI plugin to prevent excessive resource consumption by unauthorized requests.

In addition to this vulnerability (CVE-2025-49763), another CVE, CVE-2025-31698, was recently published, concerning ACL misconfigurations in Apache Traffic Server. This highlights the need for diligent security practices. Users of Apache Traffic Server versions 10.0.0 through 10.0.6 and 9.0.0 through 9.2.10 are advised to upgrade to versions 9.2.11 or 10.0.6 to address the ACL issue. A new setting, proxy.config.acl.subjects, allows administrators to specify which IP addresses to use for ACL checks when ATS is configured to accept PROXY protocol.


References :

• thecyberexpress.com: This article provides detailed information on the vulnerability, its impact, and mitigation strategies.
• Blog: CVE-2025-49763 – Remote DoS via Memory Exhaustion in Apache Traffic Server via ESI Plugin
• Tenable Blog: This article discusses various cybersecurity topics, including the Apache Traffic Server vulnerability CVE-2025-49763.
• www.imperva.com: Remote attackers can trigger an avalanche of internal ESI requests, exhausting memory and causing denial-of-service in Apache Traffic Server.

Classification:

• HashTags: #Apache #TrafficServer #DoS
• Company: Apache
• Target: cloud service providers
• Product: Apache Traffic Server
• Feature: ESI plugin
• Malware: CVE-2025-49763
• Type: Vulnerability
• Severity: Major