CVE-2022-23206

This CVE concerns Apache Traffic Control Traffic Ops. An unprivileged user reachable over HTTPS could send a crafted POST to /user/login/oauth, enabling SSRF to scan a server port within Traffic Ops reach. Affected are Traffic Ops prior to 6.1.0 or 5.1.6. Impact is described as port-scanning capa...

CVE-2017-7670

CVE-2017-7670 describes a Slowloris-style DoS affecting the Traffic Router component of Apache Traffic Control. The vulnerability occurs because TCP connections on the configured DNS port can stay in the ESTABLISHED state indefinitely. If enough connections remain open, they exhaust the thread po...

CVE-2025-61581

CVE-2025-61581 describes an Inefficient Regular Expression Complexity vulnerability in Apache Traffic Control affecting all versions. The description states that users with access to the Traffic Router management interface could supply malicious patterns, potentially causing unavailability. The p...