# CVE-2026-119574: Traefik FastProxy data race in HTTP/1 upgrades

Source: https://junglewise.ai/threats/cve-2026-119574-traefik-from-3-2-0-before-3-7-15-contains-a-data-race-in-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119574 · Severity: medium · CVSS 5.9 · Published 2026-10-30

Traefik is a reverse proxy and API gateway that routes incoming traffic to backend services. The experimental FastProxy feature in Traefik 3.2.0 through 3.7.14 contains a data race vulnerability that allows unauthenticated attackers to crash the process by repeatedly opening and closing WebSocket or other HTTP/1 protocol upgrade connections. A successful attack results in denial of service, taking down the proxy and disrupting all traffic it handles.

Technologies: [Traefik](https://junglewise.ai/threats/technologies/traefik). Vendors: [Traefik](https://junglewise.ai/threats/vendors/traefik).

## Quick answers

**Is CVE-2026-119574 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119574 being exploited in the wild.

**How severe is CVE-2026-119574?** Medium severity, with a CVSS score of 5.9, published 30 October 2026.

**Which products and versions are affected?** Traefik 3.2.0 through 3.7.14.

**Is there a fix for CVE-2026-119574?** Yes: fixed in v3.7.15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119574 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-119574?** Check whether you run Traefik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in v3.7.15

## Technical details

A data race exists in the FastProxy component's handling of HTTP/1 protocol upgrades (e.g., WebSocket): after a backend sends a 101 Switching Protocols response, the connection pool and tunnel copier both access the same unsynchronized bufio.Reader, corrupting its internal state. An unauthenticated network attacker can trigger this by repeatedly opening upgraded connections and aborting them, causing an unrecovered panic that terminates the Traefik process. The vulnerability affects Traefik v3.2.0 through v3.7.14; FastProxy was introduced in v3.2 so v2 is unaffected.

## Affected products

- Traefik Traefik 3.2.0 through 3.7.14

## Timeline

- 2026-10-16: advisory
- 2026-10-16: patched: v3.7.15 released

## References

- [https://github.com/traefik/traefik/security/advisories/GHSA-ww7c-q3mv-xx22](https://github.com/traefik/traefik/security/advisories/GHSA-ww7c-q3mv-xx22)
- [https://www.vulncheck.com/advisories/traefik-3.2.0-before-3.7.15-fastproxy-data-race-denial-of-service](https://www.vulncheck.com/advisories/traefik-3.2.0-before-3.7.15-fastproxy-data-race-denial-of-service)

## Related threats

- [Traefik ForwardAuth connection pool identity leak via NTLM/Negotiate](https://junglewise.ai/threats/cve-2026-121966-traefik-2-x-before-2-11-60-and-3-x-before-3-7-16-sends)
- [Traefik authentication bypass in TLS options resolution](https://junglewise.ai/threats/cve-2026-114656-traefik-before-2-11-58-and-3-7-13-contains-an-authentication)
- [Traefik NTLM/Kerberos TLS configuration bypass](https://junglewise.ai/threats/cve-2026-114642-traefik-2-11-0-before-2-11-58-and-3-0-0-before-3-7-14-stores-its)
- [Traefik authentication bypass in backend connection pool](https://junglewise.ai/threats/cve-2026-114639-traefik-2-11-0-before-2-11-58-and-3-0-0-before-3-7-14-contains)
- [Traefik Kubernetes Ingress missing namespace validation in annotations](https://junglewise.ai/threats/cve-2026-112778-traefik-before-2-11-46-3-x-before-3-6-17-and-3-7-0-lack)