- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 8 · 1 critical, 1 high
- Registry
- pkg.go.dev
Advisories 8
- CVE-2025-61581High 7.5
Apache Traffic Control: ReDoS issue in Traffic Router configuration
Affected: all versions.
- CVE-2024-45387Critical 9.9
Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments
Affected: all versions.
- CVE-2022-23206Unrated
Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth
Affected: from 6.0.0, fixed in 6.1.0; fixed in 5.1.6; fixed in 5.1.6+incompatible; from 6.0.0+incompatible, fixed in 6.1.0+incompatible.
- CVE-2021-43350Unrated
LDAP filter injection vulnerability in Traffic Ops
Affected: from 6.0.0, fixed in 6.0.1; from 5.1.0, fixed in 5.1.4; from 5.1.0+incompatible, fixed in 5.1.4+incompatible; from 6.0.0+incompatible, fixed in 6.0.1+incompatible.
- CVE-2021-42009Unrated
Apache Traffic Control Traffic Ops Email Injection Vulnerability
Affected: fixed in 5.1.3+incompatible; fixed in 5.1.3.
- CVE-2020-17522Unrated
When ORT (now via atstccfg) generates ip_allow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files…
Affected: fixed in 5.0.0.
- CVE-2019-12405Unrated
Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API…
Affected: from 3.0.0, fixed in 3.0.2-RC1.
- CVE-2017-7670Unrated
The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack.
Affected: from 1.1.4, fixed in 1.8.1; from 2.0.0-RC0, fixed in 2.0.0; from 2.1.0-RC0, fixed in 2.1.0-RC1; fixed in 0.0.0-20170531185407-738c10fa1b58; fixed in 1.1.4-0.20170531185407-738c10fa1b58.