Skip to content
fr Sign in
8.2 High

CVE-2026-119574 Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated…

Description

Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connections such as WebSocket, corrupting the unsynchronized shared bufio.Reader and triggering an unrecovered panic that terminates Traefik.

Affected products and versions

Product Affected versions Fixed in
traefik 3.7 earliest → < 3.7.15 3.7.15
traefik 3.2 3.2.0 → < 3.7.15 3.7.15

References

Timeline

  1. Published
  2. Last modified

Other CVEs of traefik

The 80 CVEs of traefik →
CVE-2026-121966 Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak 7.0 High CVE-2026-119573 Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the… 2.1 Low CVE-2026-119572 Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider 7.0 High CVE-2026-114656 Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher 6.9 Medium
Track this CVE