Apache Traffic Control CVE-2025-61581

Exploitation requires access to the management interface of the Traffic Router component, where an attacker can supply attacker-controlled regular-expression patterns that are evaluated inefficiently (CWE-1333), causing CPU exhaustion and service unavailability. The key LIMITING factor is this management-interface access requirement stated in the description, which conflicts with the CVSS PR:N and in practice means the attacker is not a fully anonymous internet user; impact is availability-only (C:N/I:N). Because the project is retired with no patch, the vendor's recommended mitigation is to restrict access to the instance to trusted users or migrate to an alternative product - so the practical condition for risk is an insufficiently restricted or exposed Traffic Router management interface.

Signals are moderate and largely consistent in pointing to a non-urgent issue. The official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) scores availability-only impact via an unauthenticated network path, but this DIRECTLY CONFLICTS with the description, which states that only 'people with access to the management interface of the Traffic Router component' can supply the malicious patterns - that is a privileged/authenticated action, not PR:N. This discrepancy should be verified; realistically the attacker needs management-interface access, which materially lowers real-world risk below what the 7.5 implies. EPSS is low (0.74%, 53rd percentile), there is NO CISA KEV listing and NO public exploit identified, so there is no evidence of active exploitation. No SSVC decision data was provided. Net assessment: a genuine availability (ReDoS, CWE-1333) weakness but a LOW operational priority - it is availability-only (no confidentiality/integrity impact), gated in practice by access to a management interface, present in a RETIRED product with no vendor patch, and shows no exploitation momentum. Treat as a configuration/access-hardening item rather than an emergency patch.

An actor who can reach the Traffic Router management interface submits a crafted regular-expression pattern that triggers catastrophic backtracking, pinning CPU and rendering the Traffic Router unavailable for DNS/HTTP request routing. No public exploit code has been identified; because impact is availability-only and the description implies the attacker must already have management-interface access, this is closer to abuse-by-insider or by someone on an insufficiently restricted interface than to blind internet exploitation.