CVE-2026-52852

Overview

Traccar prior to version 6.14.0 contains a denial of service vulnerability in the reporting module. An authenticated user can create a cyclic group-parent hierarchy, which causes infinite recursion when generating trips or stops reports. This condition pins a Jetty worker thread at high CPU and can eventually exhaust the web and API worker pool.

Description

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy. org.traccar.api.resource.GroupResource permits the parent cycle, while org.traccar.helper.model.AttributeUtil.lookup follows group parents without cycle detection, a visited set, or a depth limit. The storage-backed lookup reached through TripsConfig. and ReportUtils.slowTripsAndStops never terminates, pins a Jetty worker at high CPU after the client disconnects, and can exhaust the web/API worker pool when requests are repeated. The position-ingestion cache-backed path is not part of the confirmed affected scope. This issue is fixed in 6.14.0.

Impact

The primary impact is a denial of service affecting system availability. Authenticated users with group management permissions can degrade or disrupt web and API services by triggering unconstrained recursive lookups. Confidentiality and integrity are not directly impacted, but service availability is compromised for all users.

Remediation

Upgrade Traccar to version 6.14.0 or later where cycle detection and depth limits are implemented for group-parent hierarchies. Restrict group management and reporting permissions to trusted administrative accounts to reduce the attack surface.

Risk context

The vulnerability is rated as medium severity with a CVSS score of 6.5 and a very low EPSS score of 0.00032. While exploitation requires authenticated access and specific permissions, repeated requests can lead to resource exhaustion and service disruption.

Affected products

• Traccar < 6.14.0