CVSS 3.1
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се по мрежата, без особени условия, с обикновен потребителски вход и без действие от потребителя.
- Експлоатация: има публичен пример за експлоатация
- Атаката не може да се автоматизира
Описание
Оригинално описание
Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy. org.traccar.api.resource.GroupResource permits the parent cycle, while org.traccar.helper.model.AttributeUtil.lookup follows group parents without cycle detection, a visited set, or a depth limit. The storage-backed lookup reached through TripsConfig. and ReportUtils.slowTripsAndStops never terminates, pins a Jetty worker at high CPU after the client disconnects, and can exhaust the web/API worker pool when requests are repeated. The position-ingestion cache-backed path is not part of the confirmed affected scope. This issue is fixed in 6.14.0.
Засегнати продукти
- traccar traccar: < 6.14.0
Вид слабост
История
- 17 септември 2026 Публикувано
Други уязвимости в traccar traccar
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-52852
- https://nvd.nist.gov/vuln/detail/CVE-2026-52852
- https://github.com/traccar/traccar/security/advisories/GHSA-6qh3-234v-r254
- https://github.com/traccar/traccar/commit/8f6f59ac29d8b1222254e938672a0d99098fd800
- https://github.com/traccar/traccar/releases/tag/v6.14.0