Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. github.com/apache/trafficcontrol
  4. ›
  5. CVE-2017-7670

CVE-2017-7670: Apache Traffic Control vulnerable to Slowloris-style Denial of Service attack

May 13, 2022 (updated July 9, 2025)

The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections made on the configured DNS port will remain in the ESTABLISHED state until the client explicitly closes the connection or Traffic Router is restarted. If connections remain in the ESTABLISHED state indefinitely and accumulate in number to match the size of the thread pool dedicated to processing DNS requests, the thread pool becomes exhausted. Once the thread pool is exhausted, Traffic Router is unable to service any DNS request, regardless of transport protocol.

References

  • github.com/advisories/GHSA-f2wr-c4c4-xjg7
  • github.com/apache/trafficcontrol
  • github.com/apache/trafficcontrol/commit/738c10fa1b5861e4cc3944dc7c3065d16f4a708c
  • github.com/apache/trafficcontrol/pull/633
  • github.com/apache/trafficcontrol/pull/634
  • lists.apache.org/thread.html/42b207e9f526353b504591684bd02a5e9fcb4b8f28534253d07740a0@%3Cusers.trafficcontrol.apache.org%3E
  • lists.apache.org/thread.html/bb09fc29e9c2ee85b118a3d5748a8a523d30cf691ff8b606c6a1748c@%3Ccommits.trafficcontrol.apache.org%3E
  • lists.apache.org/thread.html/r3c675031ac220b5eae64a9c84a03ee60045c6045738607dca4a96cb8@%3Ccommits.trafficcontrol.apache.org%3E
  • nvd.nist.gov/vuln/detail/CVE-2017-7670

Code Behaviors & Features

Detect and mitigate CVE-2017-7670 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 1.1.4 before 1.8.1, all versions starting from 2.0.0-RC0 before 2.0.0, all versions starting from 2.1.0-RC0 before 2.1.0-RC1, version 2.1.0-RC0

Fixed versions

  • 1.8.1
  • 2.0.0
  • 2.1.0-RC1

Solution

Upgrade to versions 1.8.1, 2.0.0, 2.1.0-RC1 or above.

Impact 7.5 HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-400: Uncontrolled Resource Consumption

Source file

go/github.com/apache/trafficcontrol/CVE-2017-7670.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Thu, 28 Aug 2025 00:19:11 +0000.