CVE-2025-49763
Apache Traffic Server: Remote DoS via memory exhaustion in ESI Plugin
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted.
Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10.
Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache Traffic Server: Remote DoS via memory exhaustion in ESI Plugin
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted.
Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10.
Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.
- Record
CVE-2025-49763- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2025-18741
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted.
Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10.
Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.
- Record
EUVD-2025-18741- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jrg5-jw7r-rxg9
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory...
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted.
Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10.
Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.
- Record
GHSA-jrg5-jw7r-rxg9- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted.
Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10.
Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.
- Record
CVE-2025-49763- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
Apache Traffic Server: Remote DoS via memory exhaustion in ESI Plugin
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted.
Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10.
Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.
- Record
CVE-2025-49763- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-49763
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10. Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.
- Record
DEBIAN-CVE-2025-49763- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVOESA-2025-1731
trafficserver security update
Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache.
Security Fix(es):
Apache Traffic Server (ATS) is a set of scalable HTTP proxy and caching servers from the Apache Foundation in the United States. Apache Traffic Server (ATS) versions 10.0.0 to 10.0.6 and 9.0.0 to 9.2.10 have access control error vulnerabilities due to the ACL configuration not using the IP address provided by the PROXY protocol.(CVE-2025-31698)
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted.
Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10.
Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.(CVE-2025-49763)
- Record
OESA-2025-1731- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2025-1732
trafficserver security update
Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache.
Security Fix(es):
Apache Traffic Server (ATS) is a set of scalable HTTP proxy and caching servers from the Apache Foundation in the United States. Apache Traffic Server (ATS) versions 10.0.0 to 10.0.6 and 9.0.0 to 9.2.10 have access control error vulnerabilities due to the ACL configuration not using the IP address provided by the PROXY protocol.(CVE-2025-31698)
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted.
Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10.
Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.(CVE-2025-49763)
- Record
OESA-2025-1732- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2025-1904
trafficserver security update
Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache.
Security Fix(es):
Apache Traffic Server (ATS) is a set of scalable HTTP proxy and caching servers from the Apache Foundation in the United States. Apache Traffic Server (ATS) versions 10.0.0 to 10.0.6 and 9.0.0 to 9.2.10 have access control error vulnerabilities due to the ACL configuration not using the IP address provided by the PROXY protocol.(CVE-2025-31698)
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted.
Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10.
Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.(CVE-2025-49763)
- Record
OESA-2025-1904- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2026-1019
trafficserver security update
Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache.
Security Fix(es):
Improper Input Validation vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5.Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.(CVE-2024-38479)
Valid Host header field can cause Apache Traffic Server to crash on some platforms.
This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5.
Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.(CVE-2024-50305)
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted.Users can use a new setting for the plugin (--max-inclusion-depth) to limit it.This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10.Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.(CVE-2025-49763)
- Record
OESA-2026-1019- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-49763
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10. Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.
- Record
UBUNTU-CVE-2025-49763- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
trafficserverDebian:12 |
before 9.2.5+ds-0+deb12u3, plus listed versions 9.2.0+ds-29.2.0+ds-2+deb12u19.2.1+ds-19.2.2+ds-19.2.3+ds-1 Show 6 moreShow less9.2.3+ds-1+deb12u19.2.4+ds-0+deb12u19.2.4+ds-19.2.4+ds-29.2.5+ds-0+deb12u19.2.5+ds-0+deb12u2 |
9.2.5+ds-0+deb12u3 |
trafficserverDebian:12 From an advisory covering 3 CVEs |
before 9.2.5+ds-0+deb12u3, plus listed versions 9.2.0+ds-29.2.0+ds-2+deb12u19.2.1+ds-19.2.2+ds-19.2.3+ds-1 Show 6 moreShow less9.2.3+ds-1+deb12u19.2.4+ds-0+deb12u19.2.4+ds-19.2.4+ds-29.2.5+ds-0+deb12u19.2.5+ds-0+deb12u2 |
9.2.5+ds-0+deb12u3 |
trafficserveropenEuler:24.03-LTS-SP1 From an advisory covering 2 CVEs |
before 9.2.11-1.oe2403sp1 | 9.2.11-1.oe2403sp1 |
trafficserveropenEuler:24.03-LTS From an advisory covering 2 CVEs |
before 9.2.11-1.oe2403 | 9.2.11-1.oe2403 |
trafficserveropenEuler:24.03-LTS-SP2 From an advisory covering 2 CVEs |
before 9.2.11-1.oe2403sp2 | 9.2.11-1.oe2403sp2 |
trafficserveropenEuler:20.03-LTS-SP4 From an advisory covering 3 CVEs |
before 9.1.4-5.oe2003sp4 | 9.1.4-5.oe2003sp4 |
trafficserverUbuntu:16.04:LTS |
All versions, plus listed versions 5.3.0-2ubuntu15.3.0-2ubuntu2 |
None known |
trafficserverUbuntu:18.04:LTS |
All versions, plus listed versions 7.0.0-57.1.2+ds-27.1.2+ds-2build17.1.2+ds-3 |
None known |
trafficserverUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 8.0.5+ds-18.0.5+ds-28.0.5+ds-2build18.0.5+ds-2ubuntu18.0.5+ds-38.0.5+ds-3ubuntu0.1~esm1 |
None known |
trafficserverUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 8.1.1+ds-1.19.1.1+ds-2build19.1.1+ds-2ubuntu0.1~esm19.1.1+ds-2ubuntu0.19.1.1+ds-2ubuntu0.1+esm1 |
None known |
trafficserverUbuntu:24.04:LTS |
All versions, plus listed versions 9.2.1+ds-1build19.2.2+ds-19.2.3+ds-19.2.3+ds-1+deb12u19.2.3+ds-1+deb12u1build19.2.3+ds-1+deb12u1build39.2.3+ds-1+deb12u1build49.2.3+ds-1+deb12u1ubuntu0.1 |
None known |
trafficserverUbuntu:25.10 |
All versions, plus listed versions 9.2.5+ds-1ubuntu19.2.5+ds-1ubuntu29.2.5+ds-1ubuntu2.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-49763 is a high vulnerability (CVSS 7.5) in Apache Traffic Server, published June 19, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile. Fixed in trafficserver 9.2.5+ds-0+deb12u3.
References
lists.apache.org/thread/15t32nxbypqg1m2smp640vjx89o6v5f8
nvd.nist.gov/vuln/detail/CVE-2025-49763
github.com/advisories/GHSA-jrg5-jw7r-rxg9
security-tracker.debian.org/tracker/CVE-2025-49763
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1731
Show 11 moreShow less
ubuntu.com/security/CVE-2025-49763
cve.org/CVERecord?id=CVE-2025-49763
openwall.com/lists/oss-security/2025/06/17/7