Read the docs
TI-2017-05306 Aliases CVE-2017-7670GHSA-f2wr-c4c4-xjg7

Uncontrolled resource consumption in Apache Traffic Control

Priority MEDIUM 40CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections made on the configured DNS port will remain in the ESTABLISHED state until the client explicitly closes the connection or Traffic Router is restarted. If connections remain in the ESTABLISHED state indefinitely and accumulate in number to match the size of the thread pool dedicated to processing DNS requests, the thread pool becomes exhausted. Once the thread pool is exhausted, Traffic Router is unable to service any DNS request, regardless of transport protocol.

Why it matters now

EPSS 0.04671 91st percentileScored 2026-11-07
Fix Fixed github.com/apache/trafficcontrol (Go): 1.8.1, 2.0.0, 2.1.0-RC1 +2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Traffic Control1.8.0 incubating; 2.0.0 RC0 incubating—No fix listedCNA
—github.com/apache/trafficcontrol (Go)1.1.4 to before 1.8.11.8.1Patch availableGHSA-f2wr-c4c4-xjg7
—github.com/apache/trafficcontrol (Go)2.0.0-RC0 to before 2.0.02.0.0Patch availableGHSA-f2wr-c4c4-xjg7
—github.com/apache/trafficcontrol (Go)2.1.0-RC0 to before 2.1.0-RC12.1.0-RC1Patch availableGHSA-f2wr-c4c4-xjg7
—github.com/apache/trafficcontrol (Go)before 0.0.0-20170531185407-738c10fa1b580.0.0-20170531185407-738c10fa1b58Patch availableGHSA-f2wr-c4c4-xjg7
—github.com/apache/trafficcontrol (Go)0.0.0 to before 1.1.4-0.20170531185407-738c10fa1b581.1.4-0.20170531185407-738c10fa1b58Patch availableGHSA-f2wr-c4c4-xjg7
  • Apache Traffic Control VendorApache Affected 1.8.0 incubating; 2.0.0 RC0 incubating Fixed in — No fix listed CNA
  • github.com/apache/trafficcontrol (Go) Vendor— Affected 1.1.4 to before 1.8.1 Fixed in 1.8.1 Patch available GHSA-f2wr-c4c4-xjg7
  • github.com/apache/trafficcontrol (Go) Vendor— Affected 2.0.0-RC0 to before 2.0.0 Fixed in 2.0.0 Patch available GHSA-f2wr-c4c4-xjg7
  • github.com/apache/trafficcontrol (Go) Vendor— Affected 2.1.0-RC0 to before 2.1.0-RC1 Fixed in 2.1.0-RC1 Patch available GHSA-f2wr-c4c4-xjg7
  • github.com/apache/trafficcontrol (Go) Vendor— Affected before 0.0.0-20170531185407-738c10fa1b58 Fixed in 0.0.0-20170531185407-738c10fa1b58 Patch available GHSA-f2wr-c4c4-xjg7
  • github.com/apache/trafficcontrol (Go) Vendor— Affected 0.0.0 to before 1.1.4-0.20170531185407-738c10fa1b58 Fixed in 1.1.4-0.20170531185407-738c10fa1b58 Patch available GHSA-f2wr-c4c4-xjg7

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:apache:traffic_control:*:*:*:*:*:*:*:*up to 1.8.0VulnerableApache
cpe:2.3:a:apache:traffic_control:1.8.1:rc0:*:*:*:*:*:*1.8.1 rc0VulnerableApache
cpe:2.3:a:apache:traffic_control:2.0.0:rc1:*:*:*:*:*:*2.0.0 rc1VulnerableApache
cpe:2.3:a:apache:traffic_control:2.0.0:rc2:*:*:*:*:*:*2.0.0 rc2VulnerableApache
cpe:2.3:a:apache:traffic_control:2.0.0:rc3:*:*:*:*:*:*2.0.0 rc3VulnerableApache
cpe:2.3:a:apache:traffic_control:2.0.0:rc4:*:*:*:*:*:*2.0.0 rc4VulnerableApache
cpe:2.3:a:apache:traffic_control:2.0.0:rc5:*:*:*:*:*:*2.0.0 rc5VulnerableApache
cpe:2.3:a:apache:traffic_control:2.0.0:rc6:*:*:*:*:*:*2.0.0 rc6VulnerableApache
  • cpe:2.3:a:apache:traffic_control:*:*:*:*:*:*:*:* Versions up to 1.8.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:traffic_control:1.8.1:rc0:*:*:*:*:*:* Versions 1.8.1 rc0 Vulnerable ·Apache
  • cpe:2.3:a:apache:traffic_control:2.0.0:rc1:*:*:*:*:*:* Versions 2.0.0 rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:traffic_control:2.0.0:rc2:*:*:*:*:*:* Versions 2.0.0 rc2 Vulnerable ·Apache
  • cpe:2.3:a:apache:traffic_control:2.0.0:rc3:*:*:*:*:*:* Versions 2.0.0 rc3 Vulnerable ·Apache
  • cpe:2.3:a:apache:traffic_control:2.0.0:rc4:*:*:*:*:*:* Versions 2.0.0 rc4 Vulnerable ·Apache
  • cpe:2.3:a:apache:traffic_control:2.0.0:rc5:*:*:*:*:*:* Versions 2.0.0 rc5 Vulnerable ·Apache
  • cpe:2.3:a:apache:traffic_control:2.0.0:rc6:*:*:*:*:*:* Versions 2.0.0 rc6 Vulnerable ·Apache

Remediation

  • Fix · GHSA-f2wr-c4c4-xjg7 github.com/apache/trafficcontrol (Go) Fixed in 1.8.1 Advisory →
  • Fix · GHSA-f2wr-c4c4-xjg7 github.com/apache/trafficcontrol (Go) Fixed in 2.0.0 Advisory →
  • Fix · GHSA-f2wr-c4c4-xjg7 github.com/apache/trafficcontrol (Go) Fixed in 2.1.0-RC1 Advisory →
  • Fix · GHSA-f2wr-c4c4-xjg7 github.com/apache/trafficcontrol (Go) Fixed in 0.0.0-20170531185407-738c10fa1b58 Advisory →
  • Fix · GHSA-f2wr-c4c4-xjg7 github.com/apache/trafficcontrol (Go) Fixed in 1.1.4-0.20170531185407-738c10fa1b58 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-7670
  2. 2026-10-03 Alias added: GHSA-f2wr-c4c4-xjg7

References

Advisory 1

Other 10

  • TI-2024-30436 Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments CVSS 3.1CRITICAL 9.9
  • TI-2021-19325 LDAP filter injection vulnerability in Traffic Ops CVSS 3.1CRITICAL 9.8
  • TI-2019-09251 Improper authentication in Apache Traffic Control CVSS 3.1CRITICAL 9.8
  • TI-2025-38028 Apache Traffic Control: ReDoS issue in Traffic Router configuration CVSS 3.1HIGH 7.5
  • TI-2022-07358 Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth CVSS 3.1HIGH 7.5
  • TI-2020-13271 Incorrect permission assignment in Apache Traffic Control CVSS 3.1MEDIUM 5.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences