Description
Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connections such as WebSocket, corrupting the unsynchronized shared bufio.Reader and triggering an unrecovered panic that terminates Traefik.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| traefik | traefik | 3.2.0 – < 3.7.15 | 3.7.15 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | traefik-3.6 | No fix yet | — |
Advisories 1
- WID-SEC-2026-3980 Traefik: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 1, 2026
References
- GitHub Security Advisory (GHSA-ww7c-q3mv-xx22) vendor-advisory
- VulnCheck Advisory: Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service third-party-advisory