oss-security - [ANNOUNCE] Apache Traffic Server has an ACL issue, and also has a vulnerability in ESI processing

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAGjw+kNpwn6Hpk5n6WBgLbma7LeabiTuvc1X98e_nO82PG_XHw@mail.gmail.com>
Date: Tue, 17 Jun 2025 15:17:07 -0600
From: Masakazu Kitajo <maskit@...che.org>
To: announce@...fficserver.apache.org, Dev <dev@...fficserver.apache.org>, 
	users <users@...fficserver.apache.org>, security@...fficserver.apache.org
Cc: oss-security@...ts.openwall.com
Subject: [ANNOUNCE] Apache Traffic Server has an ACL issue, and also has a
 vulnerability in ESI processing

Description:
Apache Traffic Server has an ACL issue, and also has a vulnerability in ESI
processing

CVE:
CVE-2025-31698 - Client IP address from PROXY protocol is not used for ACL
CVE-2025-49763 - Remote DoS via memory exhaustion in ESI Plugin

Reported By:
Masakazu Kitajo (CVE-2025-31698)
Yohann Sillam (CVE-2025-49763)

Vendor:
The Apache Software Foundation

Version Affected:
ATS 9.0.0 to 9.2.10
ATS 10.0.0 to 10.0.5

Mitigation:
9.x users should upgrade to 9.2.11 or later versions
10.x users should upgrade to 10.0.6 or later versions

Please note that the new versions only provide settings to mitigate issues.
Users are expected to configure those settings to mitigate the issues if
necessary.

Users who configure Apache Traffic Server to accept PROXY protocol can use
a new setting (proxy.config.acl.subjects) to choose which IP addresses to
use for the ACL configured by ip_allow.config and remap.config. Please
refer to the documentation for the detail.

Users who use the ESI plugin can use a new setting for the plugin
(--max-inclusion-depth) to limit the maximum inclusion depth. The default
value is 3 and it prevents infinite inclusion at a minimum.

CVE:
https://www.cve.org/CVERecord?id=CVE-2025-31698
https://www.cve.org/CVERecord?id=CVE-2025-49763

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.