Description
Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' technique). A remote attacker can rapidly create and cancel HTTP/2 streams to exhaust server resources and cause service unavailability.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Traefik Traefik
Default version status: unaffected
0 to < 2.10.5affected2.10.5unaffected
pkg:golang/github.com/traefik/traefikTraefik Traefik
Default version status: unaffected
3.0.0-beta1 to < 3.0.0-beta4affected3.0.0-beta4unaffected
pkg:golang/github.com/traefik/traefikReferences
- https://github.com/traefik/traefik/security/advisories/GHSA-7v4p-328v-8v5g ↗
- https://www.vulncheck.com/advisories/traefik-denial-of-service-via-http-2-request-handling ↗
- https://access.redhat.com/security/cve/CVE-2023-54365 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2491710 ↗
- https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54365.json ↗