CVE-2025-49763: Apache Traffic Server: Remote DoS via memory exhaustion in ESI Plugin
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted.
Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10.
Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/trafficserverto a version that resolves this vulnerability.Fixed in 9.2.5+ds-0+deb12u4 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.11 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.0.6 - Configuration
Configure the ESI plugin's --max-inclusion-depth setting to limit maximum inclusion depth.
ESI plugin --max-inclusion-depth
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49763?
CVE-2025-49763 has a moderate severity rating due to its potential for excessive memory consumption.
How do I fix CVE-2025-49763?
To mitigate CVE-2025-49763, you can use the new setting for the ESI plugin by specifying the maximum inclusion depth with the option --max-inclusion-depth.
Which versions of Apache Traffic Server are affected by CVE-2025-49763?
CVE-2025-49763 affects Apache Traffic Server versions 10.0.0 to 10.0.5 and 9.0.0 to 9.2.10.
What is the risk associated with CVE-2025-49763?
The risk associated with CVE-2025-49763 is excessive memory consumption that can be exploited if malicious instructions are included.
Is there a workaround for CVE-2025-49763?
Yes, the workaround for CVE-2025-49763 involves adjusting the ESI plugin settings to limit inclusion depth.