Is CVE-2026-119574 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119574 being exploited in the wild.

How severe is CVE-2026-119574?

Medium severity, with a CVSS score of 5.9, published 30 October 2026.

Is there a fix for CVE-2026-119574?

Yes: fixed in v3.7.15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119574 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-119574?

Check whether you run Traefik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119574: Traefik FastProxy data race in HTTP/1 upgrades

CVE-2026-119574 · Severity: medium · CVSS 5.9 · Published 2026-10-30

Traefik is a reverse proxy and API gateway that routes incoming traffic to backend services. The experimental FastProxy feature in Traefik 3.2.0 through 3.7.14 contains a data race vulnerability that allows unauthenticated attackers to crash the process by repeatedly opening and closing WebSocket or other HTTP/1 protocol upgrade connections. A successful attack results in denial of service, taking down the proxy and disrupting all traffic it handles.

Technologies: Traefik. Vendors: Traefik.

Quick answers

Is CVE-2026-119574 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119574 being exploited in the wild.
How severe is CVE-2026-119574?: Medium severity, with a CVSS score of 5.9, published 30 October 2026.
Which products and versions are affected?: Traefik 3.2.0 through 3.7.14.
Is there a fix for CVE-2026-119574?: Yes: fixed in v3.7.15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119574 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-119574?: Check whether you run Traefik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: v3.7.15

Technical details

A data race exists in the FastProxy component's handling of HTTP/1 protocol upgrades (e.g., WebSocket): after a backend sends a 101 Switching Protocols response, the connection pool and tunnel copier both access the same unsynchronized bufio.Reader, corrupting its internal state. An unauthenticated network attacker can trigger this by repeatedly opening upgraded connections and aborting them, causing an unrecovered panic that terminates the Traefik process. The vulnerability affects Traefik v3.2.0 through v3.7.14; FastProxy was introduced in v3.2 so v2 is unaffected.

Affected products

Traefik Traefik 3.2.0 through 3.7.14

Timeline

2026-10-16: advisory
2026-10-16: patched: v3.7.15 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.