CVE-2026-52852 Details
Description
Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy. org.traccar.api.resource.GroupResource permits the parent cycle, while org.traccar.helper.model.AttributeUtil.lookup follows group parents without cycle detection, a visited set, or a depth limit. The storage-backed lookup reached through TripsConfig. and ReportUtils.slowTripsAndStops never terminates, pins a Jetty worker at high CPU after the client disconnects, and can exhaust the web/API worker pool when requests are repeated. The position-ingestion cache-backed path is not part of the confirmed affected scope. This issue is fixed in 6.14.0.
A denial-of-service vulnerability has been identified in Traccar, an open-source GPS tracking system, in versions prior to 6.14.0. The issue arises when an authenticated user with permissions to manage groups and request reports creates a cyclic group-parent hierarchy. This cyclic structure is not properly handled by the application's group lookup logic, allowing an infinite loop to occur when a trips or stops report is requested for a device within the cycle. The loop consumes high CPU resources and can exhaust the web/API worker pool, causing a server-wide denial-of-service condition.
Users are advised to update to Traccar version 6.14.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/traccar/traccar/security/advisories/GHSA-6qh3-234v-r254 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/traccar/traccar/commit/8f6f59ac29d8b1222254e938672a0d99098fd800 | [email protected] | Source CodeVendor |
| https://github.com/traccar/traccar/releases/tag/v6.14.0 | [email protected] | Release NotesVendor |
| https://github.com/traccar/traccar/security/advisories/GHSA-6qh3-234v-r254 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Traccar | <= 6.13.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |