Skip to content
CVE Tracker
Back

CVE-2017-7670

The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack.…

High7.5EPSS 4.7%
Published
Updated
Reserved
Assigned by
apache

Description

The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections made on the configured DNS port will remain in the ESTABLISHED state until the client explicitly closes the connection or Traffic Router is restarted. If connections remain in the ESTABLISHED state indefinitely and accumulate in number to match the size of the thread pool dedicated to processing DNS requests, the thread pool becomes exhausted. Once the thread pool is exhausted, Traffic Router is unable to service any DNS request, regardless of transport protocol.

Scores

CVSS scores of CVE-2017-7670, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.0High7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (exploitation in 30 days)
4.7% · top 8.2% of all CVEs (3 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

Affected products

  • Apache Software Foundation · Apache Traffic Control

    • affected 1.8.0 incubating
    • affected 2.0.0 RC0 incubating

Affected packages

From reviewed advisories of the GitHub Advisory Database.

References (3)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .