CVE-2026-52852: Traccar: Uncontrolled Infinite Loop DoS via Group Parent Cycle
Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy. org.traccar.api.resource.GroupResource permits the parent cycle, while org.traccar.helper.model.AttributeUtil.lookup follows group parents without cycle detection, a visited set, or a depth limit. The storage-backed lookup reached through TripsConfig. and ReportUtils.slowTripsAndStops never terminates, pins a Jetty worker at high CPU after the client disconnects, and can exhaust the web/API worker pool when requests are repeated. The position-ingestion cache-backed path is not part of the confirmed affected scope. This issue is fixed in 6.14.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Traccarto a version that resolves this vulnerability.Fixed in 6.14.0
Event History
Frequently Asked Questions
Which deployments are affected?
Traccar versions prior to 6.14.0 are affected. The confirmed scope is the storage-backed lookup used by trips and stops reporting; the position-ingestion cache-backed path is not confirmed to be affected.
What access does an attacker need?
An attacker must be authenticated and have permission to manage groups and request reports. They must create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy.
What is the practical impact of exploitation?
The report request can enter a non-terminating lookup that consumes high CPU and keeps a Jetty worker occupied even after the client disconnects. Repeated requests can exhaust the web/API worker pool and cause denial of service.
What should be done if upgrading cannot happen immediately?
Restrict group-management and report-request permissions so that untrusted users cannot create group-parent cycles and trigger trips or stops reports. Monitor for cyclic group-parent hierarchies and repeated report requests that cause sustained CPU use or occupied web/API workers.