CVE-2025-49763
Description
A flaw was found in trafficserver. The Edge Side Includes (ESI) plugin lacks a limit on maximum inclusion depth, allowing a remote attacker to trigger excessive memory consumption by inserting malicious instructions. This condition occurs due to the plugin's inability to restrict the nesting of ESI includes, potentially leading to a denial of service. The vulnerability is triggered via a crafted ESI request.
Statement
This issue is rated as Important because it allows a remote, unauthenticated attacker to impact the availability of the service without requiring user interaction. While it requires a specific plugin to be enabled, ESI is a common feature for environments that serve dynamic content. The vulnerability does not lead to a compromise of confidentiality or integrity, preventing a "Critical" rating. Apache Traffic Server is primarily available in Red Hat environments through the community-supported EPEL repository, which is a key factor in this assessment.
Mitigation
To mitigate this flaw use a new setting for the plugin (--max-inclusion-depth) to limit it.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
If an attacker can trigger the allocation of the limited resources, but the number or size of the resources is not controlled, then the most common result is denial of service. This would prevent valid users from accessing the product, and it could potentially have an impact on the surrounding environment, i.e., the product may slow down, crash due to unhandled errors, or lock out legitimate users. For example, a memory exhaustion attack against an application could slow down the application as well as its host operating system.
Access Control,Other
Technical Impact: Bypass Protection Mechanism; Other
In some cases it may be possible to force the product to "fail open" in the event of resource exhaustion. The state of the product -- and possibly the security functionality - may then be compromised.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
