Quick answers
- Is CVE-2026-52852 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-52852 being exploited in the wild.
- How severe is CVE-2026-52852?
- Medium severity, with a CVSS score of 6.5, published 17 September 2026.
- Which products and versions are affected?
- Traccar before 6.14.0.
- Is there a fix for CVE-2026-52852?
- A patch was published on 2026-05-30: Fixed in version 6.14.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-52852 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-52852?
- Check whether you run Traccar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is an infinite loop denial of service vulnerability in Traccar prior to 6.14.0. An authenticated user with permissions to manage groups and request reports can create a cyclic group-parent hierarchy. When a trips or stops report is requested for a device within that hierarchy, the AttributeUtil.lookup() method follows group parents without detecting or preventing cycles, causing the lookup to never terminate. This pins Jetty worker threads at high CPU utilization and can exhaust the entire web/API worker pool when requests are repeated. The vulnerability requires authentication and group management privileges; the position-ingestion cache-backed path is not affected. Fixed in version 6.14.0 via cycle detection in the hierarchy traversal logic.
Affected products
- Traccar Traccar before 6.14.0
Timeline
- 2026-09-17: disclosed
- 2026-05-30: patched: Fixed in version 6.14.0