{"id":"CVE-2025-61581","revision":"fd91cd267dc14def911e3700e774644d","records":[{"revision":"fd91cd267dc14def911e3700e774644d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-61581","aliases":[],"title":"Apache Traffic Control: ReDoS issue in Traffic Router configuration","description":"** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulnerability in Apache Traffic Control.\n\nThis issue affects Apache Traffic Control: all versions.\n\nPeople with access to the management interface of the Traffic Router component could specify malicious patterns and cause unavailability.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","state":0,"publishedAt":"2025-10-16T08:40:11.865+00:00","modifiedAt":"2025-11-04T21:13:58.992+00:00","affected":[{"ecosystem":"Vendor product","name":"Apache Traffic Control","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"Apache Traffic Control\",\n                    \"vendor\": \"Apache Software Foundation\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"*\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://lists.apache.org/thread/mx2jxgnlop2f4vbqnvmrldh4pqmobxvp"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-61581","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-61581","identifiers":["CVE-2025-61581"]},"retained":false,"historicalAffected":[]}],"coverage":[]}