CVE-2026-52852 in Traccar
Summary
by MITRE • 09/17/2026
Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy. org.traccar.api.resource.GroupResource permits the parent cycle, while org.traccar.helper.model.AttributeUtil.lookup follows group parents without cycle detection, a visited set, or a depth limit. The storage-backed lookup reached through TripsConfig. and ReportUtils.slowTripsAndStops never terminates, pins a Jetty worker at high CPU after the client disconnects, and can exhaust the web/API worker pool when requests are repeated. The position-ingestion cache-backed path is not part of the confirmed affected scope. This issue is fixed in 6.14.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified within Traccar versions prior to 6.14.0 represents a critical resource exhaustion flaw rooted in insufficient validation and cycle detection mechanisms during group hierarchy traversal. As an open source GPS tracking system, Traccar relies on complex relational structures to manage devices, users, and groups. The core technical failure lies in the interaction between org.traccar.api.resource.GroupResource and org.traccar.helper.model.AttributeUtil.lookup. While GroupResource permits authenticated users with specific permissions to define group parent-child relationships without enforcing acyclic constraints, AttributeUtil performs recursive lookups of these parents without implementing any cycle detection logic, visited set tracking, or depth limits. This architectural oversight allows an attacker who possesses the permission to manage groups and request reports to construct a cyclic group-parent hierarchy. By deliberately linking groups in a loop such that A is a parent of B, B is a parent of C, and C is again a parent of A, the system enters an infinite recursion when processing certain requests.
The operational impact of this flaw manifests as a severe Denial of Service condition affecting both application availability and server resources. When a user triggers a trips or stops report for a device located within such a cyclic hierarchy, the storage-backed lookup mechanism invoked through TripsConfig and ReportUtils.slowTripsAndStops fails to terminate. The recursive function continues indefinitely, consuming CPU cycles until the process is manually terminated or crashes due to stack overflow in some environments. More critically, because this processing occurs within the web server thread pool managed by Jetty, a single malicious request can pin a worker thread at high CPU utilization even after the client has disconnected. This behavior effectively blocks that specific worker from handling other legitimate requests. If an attacker repeats these requests or coordinates multiple such attacks, they can exhaust the entire available web and API worker pool, rendering the Traccar instance unresponsive to all users and causing a complete service outage for any connected GPS tracking clients.
This vulnerability aligns with CWE-835, which describes loops that do not terminate correctly due to missing cycle detection or boundary conditions in recursive algorithms. Furthermore, from an offensive security perspective, this flaw is categorized under MITRE ATT&CK technique T1499, specifically Endpoint Denial of Service via resource exhaustion. The attack vector requires authentication and specific privileges, classifying it as a privilege escalation path for denial-of-service rather than an unauthenticated remote code execution or data breach. However, the ability to disrupt service availability is significant in operational contexts where continuous GPS tracking is critical for logistics, fleet management, or asset protection.
Mitigation strategies primarily involve upgrading to Traccar version 6.14.0 or later, which implements proper cycle detection and depth limiting within the group hierarchy traversal logic. For organizations unable to immediately patch their systems due to operational constraints, temporary mitigations include restricting the permission sets for users who can manage groups to only those with absolute trust, as well as implementing network-level rate limiting on API endpoints related to report generation and group management. Additionally, configuring Jetty worker pool limits and timeouts more aggressively may help contain the blast radius of such attacks by ensuring that pinned threads are eventually released or replaced, although this does not prevent the initial resource consumption spike. It is also important to note that while position-ingestion cache-backed paths were identified as potentially affected in broader analyses, they are explicitly excluded from the confirmed scope of this specific vulnerability report, meaning the primary risk remains concentrated on the storage-backed trip and stop reporting functions.