Executive brief
Traefik, a popular open-source edge router and load balancer, is vulnerable to a denial-of-service attack. By exploiting a flaw in how the system handles specific web traffic (HTTP/2), an attacker can overwhelm the server, causing it to crash or become unresponsive to legitimate users. This can lead to significant service outages and business disruption.
Technical details
Traefik is affected by a denial-of-service vulnerability inherited from the Go standard library's HTTP/2 implementation, specifically related to the 'Rapid Reset' technique (CVE-2023-44487). The vulnerability exists in the handling of HTTP/2 streams where a remote, unauthenticated attacker can rapidly create and cancel streams. This behavior bypasses standard concurrent stream limits, leading to uncontrolled resource consumption (CWE-400) on the server. An attacker can exploit this over the network to exhaust CPU and memory resources, resulting in a denial-of-service condition. The issue is resolved in Traefik versions 2.10.5 and 3.0.0-beta4.
Affected products
- Traefik Traefik < 2.10.5, 3.0.0-beta1 to < 3.0.0-beta4
Timeline
- 2023-10-12: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date