Inefficient Regular Expression Complexity Vulnerability in Apache Traffic Control

CVE-2025-61581

What is CVE-2025-61581?

A vulnerability has been identified in Apache Traffic Control that arises due to inefficient regular expression complexity. This issue allows users with access to the management interface of the Traffic Router component to specify malicious patterns. Such patterns can lead to system unavailability, rendering the service unstable. Since Apache Traffic Control is now a retired project, it is important for users to be aware that no further updates or patches will be made available to remediate this vulnerability. As a precaution, it is strongly advised to either restrict access to trusted users or seek alternative solutions.

References