CVE-2021-43350: Apache Traffic Control

Critical severity, CVSS 9.8. EPSS: 4.8% chance of exploitation in the next 30 days.

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter.

Affected products

• Apache Traffic Control: from 5.1.0, before 5.1.4 (fixed in 5.1.4); from 6.0.0, before 6.0.1 (fixed in 6.0.1); version 5.1.4 only; version 6.0.1 only

Published 2021-11-11. Last modified 2026-06-17.