Description: Apache Traffic Server has an ACL issue, and also has a vulnerability in ESI processing
CVE: CVE-2025-31698 - Client IP address from PROXY protocol is not used for ACL CVE-2025-49763 - Remote DoS via memory exhaustion in ESI Plugin Reported By: Masakazu Kitajo (CVE-2025-31698) Yohann Sillam (CVE-2025-49763) Vendor: The Apache Software Foundation Version Affected: ATS 9.0.0 to 9.2.10 ATS 10.0.0 to 10.0.5 Mitigation: 9.x users should upgrade to 9.2.11 or later versions 10.x users should upgrade to 10.0.6 or later versions Please note that the new versions only provide settings to mitigate issues. Users are expected to configure those settings to mitigate the issues if necessary. Users who configure Apache Traffic Server to accept PROXY protocol can use a new setting (proxy.config.acl.subjects) to choose which IP addresses to use for the ACL configured by ip_allow.config and remap.config. Please refer to the documentation for the detail. Users who use the ESI plugin can use a new setting for the plugin (--max-inclusion-depth) to limit the maximum inclusion depth. The default value is 3 and it prevents infinite inclusion at a minimum. CVE: https://www.cve.org/CVERecord?id=CVE-2025-31698 https://www.cve.org/CVERecord?id=CVE-2025-49763
