LiveActive security incident?Get immediate response
CVE Record

CVE-2017-7670: The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris...

The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections made on the configured DNS port will remain in the ESTABLISHED state until the client explicitly closes the connection or Traffic Router is restarted. If connections remain in the ESTABLISHED state indefinitely and accumulate in number to match the size of the thread pool dedicated to processing DNS requests, the thread pool becomes exhausted. Once the thread pool is exhausted, Traffic Router is unable to service any DNS request, regardless of transport protocol.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This flaw can make Apache Traffic Control Traffic Router stop answering DNS requests. An attacker who can open and hold TCP connections to the configured DNS port may exhaust the DNS request thread pool, causing outage for services relying on that Traffic Router.

Executive priority

Prioritize if Traffic Router supports production DNS resolution or CDN routing. The business impact is availability loss, not cited data theft or code execution. Internet-exposed or partner-exposed DNS ports raise urgency.

Technical view

Traffic Router leaves TCP connections on its configured DNS port in ESTABLISHED state until client close or Traffic Router restart. Accumulated held connections can consume the DNS processing thread pool. Once exhausted, Traffic Router cannot service DNS requests over any transport protocol.

Likely exposure

Exposure is limited to Apache Traffic Control Traffic Router deployments running 1.8.0 incubating or 2.0.0 RC0 incubating, especially where the configured DNS port accepts TCP connections from untrusted networks.

Exploitation context

The bundle does not cite active exploitation, KEV listing, exploit code, or weaponized tooling. The described attack is a Slowloris-style denial of service requiring network access to the Traffic Router DNS port.

Researcher notes

The provided record lacks CVSS, CWE, fixed version, and detailed vendor mitigation text. Analysis is grounded in the CVE description and Apache mailing-list references. Do not claim exploitation without additional evidence.

Mitigation direction

  • Check Apache Traffic Control vendor guidance for the supported fix or upgrade path.
  • Move affected incubating Traffic Router releases out of production where feasible.
  • Restrict TCP access to the Traffic Router DNS port to trusted networks.
  • Monitor for abnormal long-lived established TCP sessions on the DNS port.
  • Treat Traffic Router restart as temporary recovery, not remediation.

Validation and detection

  • Inventory Apache Traffic Control deployments and identify Traffic Router versions.
  • Confirm whether 1.8.0 incubating or 2.0.0 RC0 incubating is present.
  • Review network exposure of the configured DNS port, especially TCP reachability.
  • Check operational telemetry for accumulated established DNS-port TCP sessions.
  • Confirm remediation against Apache guidance before closing the finding.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2017-7670 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Apache Software FoundationApache Traffic Control1.8.0 incubating, 2.0.0 RC0 incubatingListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.