Executive brief
Traccar is an open-source GPS tracking system used to monitor vehicle and asset locations in real time. An authenticated user with group management permissions can create circular parent-child group relationships and request reports, causing the application to enter an infinite loop that consumes CPU and blocks worker threads, making the system unresponsive to legitimate requests.
Technical details
This is an infinite loop denial of service vulnerability in Traccar prior to 6.14.0. An authenticated user with permissions to manage groups and request reports can create a cyclic group-parent hierarchy. When a trips or stops report is requested for a device within that hierarchy, the AttributeUtil.lookup() method follows group parents without detecting or preventing cycles, causing the lookup to never terminate. This pins Jetty worker threads at high CPU utilization and can exhaust the entire web/API worker pool when requests are repeated. The vulnerability requires authentication and group management privileges; the position-ingestion cache-backed path is not affected. Fixed in version 6.14.0 via cycle detection in the hierarchy traversal logic.
Affected products
- Traccar Traccar before 6.14.0
Timeline
- 2026-09-17: disclosed
- 2026-05-30: patched: Fixed in version 6.14.0