[ANNOUNCE] Apache Traffic Server has an ACL issue, and also has a vulnerability in ESI processing

[Masakazu Kitajo <maskit () apache org>]

Description:
Apache Traffic Server has an ACL issue, and also has a vulnerability in ESI
processing

CVE:
CVE-2025-31698 - Client IP address from PROXY protocol is not used for ACL
CVE-2025-49763 - Remote DoS via memory exhaustion in ESI Plugin

Reported By:
Masakazu Kitajo (CVE-2025-31698)
Yohann Sillam (CVE-2025-49763)

Vendor:
The Apache Software Foundation

Version Affected:
ATS 9.0.0 to 9.2.10
ATS 10.0.0 to 10.0.5

Mitigation:
9.x users should upgrade to 9.2.11 or later versions
10.x users should upgrade to 10.0.6 or later versions

Please note that the new versions only provide settings to mitigate issues.
Users are expected to configure those settings to mitigate the issues if
necessary.

Users who configure Apache Traffic Server to accept PROXY protocol can use
a new setting (proxy.config.acl.subjects) to choose which IP addresses to
use for the ACL configured by ip_allow.config and remap.config. Please
refer to the documentation for the detail.

Users who use the ESI plugin can use a new setting for the plugin
(--max-inclusion-depth) to limit the maximum inclusion depth. The default
value is 3 and it prevents infinite inclusion at a minimum.

CVE:
https://www.cve.org/CVERecord?id=CVE-2025-31698
https://www.cve.org/CVERecord?id=CVE-2025-49763