Description
Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' technique). A remote attacker can rapidly create and cancel HTTP/2 streams to exhaust server resources and cause service unavailability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Traefik | Traefik | < 2.10.5, 3.0.0-beta1 – < 3.0.0-beta4 | 2.10.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | katib-earlystopping +8 | 0.19.0-r31 | — |
| Wolfi rolling | katib-suggestion-goptuna-compat | 0.19.0-r40 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/traefik/traefik | < 2.10.5 | 2.10.5 | GHSA-7v4p-328v-8v5g |
| Go | github.com/traefik/traefik | >= 3.0.0-beta1, < 3.0.0-beta4 | 3.0.0-beta4 | GHSA-7v4p-328v-8v5g |
References
- GitHub Security Advisory (GHSA-7v4p-328v-8v5g) vendor-advisory
- VulnCheck Advisory: Traefik - Denial of Service via HTTP/2 Request Handling third-party-advisory