CVE-2023-54365: Traefik denial of service via HTTP/2 Rapid Reset

CVE-2023-54365 · Severity: high · CVSS 7.5 · Published 2026-06-23

Traefik, a popular open-source edge router and load balancer, is vulnerable to a denial-of-service attack. By exploiting a flaw in how the system handles specific web traffic (HTTP/2), an attacker can overwhelm the server, causing it to crash or become unresponsive to legitimate users. This can lead to significant service outages and business disruption.

Technologies: github.com/traefik/traefik (Go), Traefik Labs Traefik Proxy. Vendors: Go, Traefik Labs.

Quick answers

Is CVE-2023-54365 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-54365 being exploited in the wild.
How severe is CVE-2023-54365?
High severity, with a CVSS score of 7.5, published 23 June 2026.
Which products and versions are affected?
github.com/traefik/traefik (Go) SEMVER:introduced=0,fixed=2.10.5; Traefik Labs Traefik Proxy < 2.10.5, 3.0.0-beta1 to < 3.0.0-beta4.
Is there a fix for CVE-2023-54365?
Yes. github.com/traefik/traefik (Go): upgrade to 2.10.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-54365 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2023-54365?
Check whether you run github.com/traefik/traefik (Go) or Traefik Labs Traefik Proxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/traefik/traefik (Go): upgrade to 2.10.5 or later
    go get github.com/traefik/traefik@v2.10.5

Technical details

Traefik is affected by a denial-of-service vulnerability inherited from the Go standard library's HTTP/2 implementation, specifically related to the 'Rapid Reset' technique (CVE-2023-44487). The vulnerability exists in the handling of HTTP/2 streams where a remote, unauthenticated attacker can rapidly create and cancel streams. This behavior bypasses standard concurrent stream limits, leading to uncontrolled resource consumption (CWE-400) on the server. An attacker can exploit this over the network to exhaust CPU and memory resources, resulting in a denial-of-service condition. The issue is resolved in Traefik versions 2.10.5 and 3.0.0-beta4.

Affected products

  • Traefik Traefik < 2.10.5, 3.0.0-beta1 to < 3.0.0-beta4

Identifiers

  • CVE-2023-54365
  • GHSA-7v4p-328v-8v5g

Timeline

  • 2023-10-12: advisory: GitHub Security Advisory published
  • 2026-06-23: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.