Executive brief
Traefik is a reverse proxy and load balancer used to route incoming traffic to backend services. A vulnerability in HTTP/2 request handling allows remote attackers to rapidly create and cancel HTTP/2 streams, exhausting server resources and rendering the service unavailable. This affects multiple Traefik installations without requiring authentication or user interaction.
Technical details
Traefik versions before 2.10.5 and 3.0.0-beta4 inherit a denial-of-service vulnerability from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the "Rapid Reset" technique). The vulnerability stems from uncontrolled resource consumption (CWE-400, CWE-770) when handling rapidly created and cancelled HTTP/2 streams. A remote, unauthenticated attacker can exploit this via the network without complexity, triggering resource exhaustion and service unavailability. Patches are available in Traefik v2.10.5 and v3.0.0-beta4.
Affected products
- Traefik Labs Traefik < 2.10.5, 3.0.0-beta3 and earlier
Timeline
- 2023-10-12: disclosed: Original advisory published as GHSA-7v4p-328v-8v5g
- 2023-10-12: patched: Patches released: Traefik v2.10.5 and v3.0.0-beta4