# Traefik HTTP/2 denial of service via rapid stream reset

Source: https://junglewise.ai/threats/traefik-http-2-denial-of-service-via-rapid-stream-reset-74eecc34  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.5 · Published 2026-06-23

Traefik is a reverse proxy and load balancer used to route incoming traffic to backend services. A vulnerability in HTTP/2 request handling allows remote attackers to rapidly create and cancel HTTP/2 streams, exhausting server resources and rendering the service unavailable. This affects multiple Traefik installations without requiring authentication or user interaction.

Technologies: [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.5, published 23 June 2026.

**Which products and versions are affected?** github.com/traefik/traefik (Go) < 2.10.5.

**Is there a fix for This vulnerability?** A patch was published on 2023-10-12: Patches released: Traefik v2.10.5 and v3.0.0-beta4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run github.com/traefik/traefik (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Traefik versions before 2.10.5 and 3.0.0-beta4 inherit a denial-of-service vulnerability from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the "Rapid Reset" technique). The vulnerability stems from uncontrolled resource consumption (CWE-400, CWE-770) when handling rapidly created and cancelled HTTP/2 streams. A remote, unauthenticated attacker can exploit this via the network without complexity, triggering resource exhaustion and service unavailability. Patches are available in Traefik v2.10.5 and v3.0.0-beta4.

## Affected products

- Traefik Labs Traefik < 2.10.5, 3.0.0-beta3 and earlier

## Timeline

- 2023-10-12: disclosed: Original advisory published as GHSA-7v4p-328v-8v5g
- 2023-10-12: patched: Patches released: Traefik v2.10.5 and v3.0.0-beta4

## References

- [https://github.com/traefik/traefik/security/advisories/GHSA-7v4p-328v-8v5g](https://github.com/traefik/traefik/security/advisories/GHSA-7v4p-328v-8v5g)

## Related threats

- [Traefik BasicAuth singleflight username enumeration via timing oracle](https://junglewise.ai/threats/cve-2026-88010-traefik-basicauth-singleflight-username-enumeration-via-timing)
- [Traefik readTimeout not enforced on HTTP/3 connections](https://junglewise.ai/threats/cve-2026-88012-traefik-readtimeout-not-enforced-on-http-3-connections)
- [Traefik ForwardAuth identity spoofing via header alias](https://junglewise.ai/threats/cve-2026-88011-traefik-forwardauth-identity-spoofing-via-header-alias)
- [Traefik rootless HTTP/1 request-target routing bypass](https://junglewise.ai/threats/cve-2026-88009-traefik-rootless-http-1-request-target-routing-bypass)
- [Traefik HTTP request smuggling via unrestricted protocol upgrade](https://junglewise.ai/threats/cve-2026-88008-traefik-http-request-smuggling-via-unrestricted-protocol-upgrade)