CVE-2026-52852

Name of the Vulnerable Software and Affected Versions Traccar versions prior to 6.14.0

Description An authenticated user with permissions to manage groups and request reports can create a cyclic group-parent hierarchy. When a trips or stops report is requested for a device within this hierarchy, the org.traccar.api.resource.GroupResource allows the cycle, and the org.traccar.helper.model.AttributeUtil.lookup() function follows group parents without cycle detection, a visited set, or a depth limit. This process, accessed via TripsConfig. and ReportUtils.slowTripsAndStops, results in a non-terminating storage-backed lookup that consumes high CPU on a Jetty worker and can exhaust the web/API worker pool if requests are repeated.

Recommendations Update to version 6.14.0.