Email Relay Vulnerability in Apache Traffic Control
Summary
CVE-2021-42009: Email relay in Apache Traffic Control in github.com/apache/trafficcontrol. Affects github.com/apache/trafficcontrol versions < 5.1.3+incompatible. Fixed in 5.1.3+incompatible. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Traffic Control is an open-source project written in Go that provides a set of tools for managing and monitoring large-scale content delivery networks (CDNs). It offers features such as traffic routing, caching, and load balancing. The email relay functionality in Apache Traffic Control allows the system to send email notifications to users for various events and alerts.
Vulnerability Detail
The email relay functionality in Apache Traffic Control is vulnerable to exploitation. An attacker could potentially abuse this feature to send unauthorized emails, leading to spamming or phishing activities. This vulnerability could result in reputational damage, compromised user accounts, and potential legal consequences. The vulnerability affects versions 0 through 5.1.2 of the Apache Traffic Control package.
How To Fix
Latest published version: v7.0.1+incompatible as of 23 Oct 2026
go get github.com/apache/trafficcontrol@v7.0.1+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.1.3+incompatible
This is the first release that contains the fix.
go get github.com/apache/trafficcontrol@v5.1.3+incompatibleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the email relay functionality in Apache Traffic Control until the package is updated to a fixed version. This can be achieved by modifying the configuration settings to prevent the system from sending any email notifications.
Conclusion
The email relay vulnerability in Apache Traffic Control poses a risk of unauthorized email sending, potentially leading to spamming and phishing activities. It is crucial for users to update their Apache Traffic Control package to version 5.1.3 or later to mitigate this vulnerability. Additionally, disabling the email relay functionality can serve as a temporary workaround.
See every vulnerability recorded for github.com/apache/trafficcontrol →
FAQ
This vulnerability allows attackers to send unauthorized emails using the email relay functionality in Apache Traffic Control. It can lead to spamming, phishing, and potential reputational damage.
Versions 0 through 5.1.2 of the Apache Traffic Control package are affected by this vulnerability.
To fix this vulnerability, upgrade to version 5.1.3 or later of the Apache Traffic Control package.
Yes, users can disable the email relay functionality in Apache Traffic Control as a temporary workaround until the package is updated.
For more information about this vulnerability, refer to the provided URL in the database_specific field of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/apache/trafficcontrol.
