8.7
Élevée
CVE-2023-54365 Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling…
Description
Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' technique). A remote attacker can rapidly create and cancel HTTP/2 streams to exhaust server resources and cause service unavailability.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| traefik 3.0 | 3.0.0-beta1 → < 3.0.0-beta4 | 3.0.0-beta4 |
| Red Hat OpenShift AI (RHOAI) | Versions non publiées | |
| Red Hat OpenShift Dev Spaces | Versions non publiées |
Références
Chronologie
- Publiée
- Dernière modification
Autres CVE de traefik
Les 80 CVE de traefik →
CVE-2026-121966
Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak
7.0
Élevée
CVE-2026-119574
Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated…
8.2
Élevée
CVE-2026-119573
Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the…
2.1
Faible
CVE-2026-119572
Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider
7.0
Élevée