# CVE-2026-52852: Traccar group hierarchy cycle denial of service

Source: https://junglewise.ai/threats/cve-2026-52852-traccar-group-hierarchy-cycle-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-52852 · Severity: medium · CVSS 6.5 · Published 2026-09-17

Traccar is an open-source GPS tracking system used to monitor vehicle and asset locations in real time. An authenticated user with group management permissions can create circular parent-child group relationships and request reports, causing the application to enter an infinite loop that consumes CPU and blocks worker threads, making the system unresponsive to legitimate requests.

Technologies: [Traccar](https://junglewise.ai/threats/technologies/traccar). Vendors: [Traccar](https://junglewise.ai/threats/vendors/traccar).

## Quick answers

**Is CVE-2026-52852 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52852 being exploited in the wild.

**How severe is CVE-2026-52852?** Medium severity, with a CVSS score of 6.5, published 17 September 2026.

**Which products and versions are affected?** Traccar before 6.14.0.

**Is there a fix for CVE-2026-52852?** A patch was published on 2026-05-30: Fixed in version 6.14.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52852 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-52852?** Check whether you run Traccar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an infinite loop denial of service vulnerability in Traccar prior to 6.14.0. An authenticated user with permissions to manage groups and request reports can create a cyclic group-parent hierarchy. When a trips or stops report is requested for a device within that hierarchy, the AttributeUtil.lookup() method follows group parents without detecting or preventing cycles, causing the lookup to never terminate. This pins Jetty worker threads at high CPU utilization and can exhaust the entire web/API worker pool when requests are repeated. The vulnerability requires authentication and group management privileges; the position-ingestion cache-backed path is not affected. Fixed in version 6.14.0 via cycle detection in the hierarchy traversal logic.

## Affected products

- Traccar Traccar before 6.14.0

## Timeline

- 2026-09-17: disclosed
- 2026-05-30: patched: Fixed in version 6.14.0

## References

- [https://github.com/traccar/traccar/commit/8f6f59ac29d8b1222254e938672a0d99098fd800](https://github.com/traccar/traccar/commit/8f6f59ac29d8b1222254e938672a0d99098fd800)
- [https://github.com/traccar/traccar/releases/tag/v6.14.0](https://github.com/traccar/traccar/releases/tag/v6.14.0)

## Related threats

- [Traccar authentication bypass in LDAP empty password handling](https://junglewise.ai/threats/cve-2026-126777-traccar-3-15-before-6-17-0-contains-an-authentication-bypass)
- [Traccar path parameter bypass in media endpoint](https://junglewise.ai/threats/cve-2026-104203-traccar-is-an-open-source-gps-tracking-system-from-5-1-until-6)
- [Traccar CSRF vulnerability in OpenID Connect authentication](https://junglewise.ai/threats/cve-2026-108738-traccar-5-7-through-6-16-0-contains-a-cross-site-request-forgery)
- [Traccar password recovery token misuse vulnerability](https://junglewise.ai/threats/cve-2026-108737-traccar-through-6-16-0-contains-a-weak-password-recovery)
- [Traccar permission SQL injection via extra JSON keys](https://junglewise.ai/threats/cve-2026-52851-traccar-permission-sql-injection-via-extra-json-keys)