Known vulnerabilities in Apache Traffic Control

Vendor: Apache Foundation
Software: Apache Traffic Control
Software CPE: cpe:2.3:a:apache_foundation:trafficcontrol:*:*:*:*:*:*:*:*
Website: https://www.apache.org
Total vulnerabilities: 8
Public exploits: 1
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Apache Traffic Control Apache Traffic Control is affected by 8 known vulnerabilities: 1 critical, 1 high, 4 medium, 2 low Critical High Medium Low

Vulnerabilities (8)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU118829 - Inefficient Regular Expression Complexity
CVE-2025-61581		 CWE-1333 Medium
No
No
 - 28.11.2025 SB2025112815
#VU101899 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-45387		 CWE-89 Low
No
No
 8.0.2 23.12.2024 SB2024122314
#VU60351 - Server-Side Request Forgery (SSRF)
CVE-2022-23206		 CWE-918 Medium
No
No
 5.1.6, 6.1.0 07.02.2022 SB2022020707
#VU58816 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-44228		 CWE-94 Critical
Available
Exploited
 5.1.5, 6.0.2 10.12.2021 SB2021121003
SB2021121101
SB2021121201
and 338 more
#VU58115 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CVE-2021-43350		 CWE-90 High
No
No
 5.1.4, 6.0.1 12.11.2021 SB2021111211
#VU57218 - Improper input validation
CVE-2021-42009		 CWE-20 Low
No
No
 6.0.0 12.10.2021 SB2021101203
#VU20927 - Resource Management Errors
CVE-2017-7670		 CWE-399 Medium
No
No
 1.8.1 08.09.2019 SB2017071003
#VU20926 - Improper Authentication
CVE-2019-12405		 CWE-287 Medium
No
No
 3.0.2 08.09.2019 SB2019090805