Containous Traefik Security Vulnerability

Containous Traefik is a reverse proxy and load balancer from Containous, USA. A security vulnerability exists in Traefik v2.10.5 and earlier, v3.0.0-beta4 and earlier, which can be exploited by an attacker to conduct a Slowloris attack when Traefik is configured to generate and update certificate...

CVE-2023-47124: Missing Release of Resource after Effective Lifetime

Traefik is an open source HTTP reverse proxy and load balancer. When Traefik is configured to use the HTTPChallenge to generate and renew the Let's Encrypt TLS certificates, the delay authorized to solve the challenge 50 seconds can be exploited by attackers to achieve a slowloris attack. This...

CVE-2023-47106: Improper Input Validation

Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path...

PT-2023-9077 · Traefik +1 · Traefik +1

Name of the Vulnerable Software and Affected Versions: Traefik versions prior to 2.10.6 Traefik versions prior to 3.0.0-beta5 Description: The issue is related to the Traefik docker container using 100% CPU when it serves as its own backend, resulting from the Docker integration in the default...

Traefik vulnerable to HTTP/2 request causing denial of service

Impact A vulnerability CVE-2023-39325 exists in Go managing HTTP/2 requests, which impacts Traefik. This vulnerability could be exploited to cause a denial of service. References - CVE-2023-44487 - CVE-2023-39325 Patches - https://github.com/traefik/traefik/releases/tag/v2.10.5 -...

GHSA-7V4P-328V-8V5G Traefik vulnerable to HTTP/2 request causing denial of service

Impact A vulnerability CVE-2023-39325 exists in Go managing HTTP/2 requests, which impacts Traefik. This vulnerability could be exploited to cause a denial of service. References - CVE-2023-44487 - CVE-2023-39325 Patches - https://github.com/traefik/traefik/releases/tag/v2.10.5 -...

PT-2026-51489

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.10.5 Description A flaw exists in the HTTP/2 request handling, inherited from the Go standard library implementation. A remote attacker can trigger a denial of service DoS by rapidly creating and canceling HTTP/2...

FreeBSD : traefik -- Resource exhaustion by malicious HTTP/2 client (7a1b2624-6a89-11ee-af06-5404a68ad561)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 7a1b2624-6a89-11ee-af06-5404a68ad561 advisory. - A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cau...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: nghttp2, minio, atlantis-fips, aactl, kubescape, aws-efs-csi-driver-fips, terraform-provider-sendgrid, node-problem-detector, terraform-provider-azurerm, bank-vaults-fips, flux-notification-controller, nfs-subdir-external-provisioner-fips,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: hugo, grype, pulumi-language-java, hey, gomplate, fuse-overlayfs-snapshotter, gke-gcloud-auth-plugin, envoy-ratelimit, amass, prometheus-adapter, gitness, frp, memcached-exporter, sigstore-scaffolding, nats, kubeflow, kots, cosign, terraform-provider-azurerm, git-lfs...

traefik -- Resource exhaustion by malicious HTTP/2 client

The traefik authors report: There is a vulnerability in GO managing HTTP/2 requests, which impacts Traefik. This vulnerability could be exploited to cause a denial of service...

Security Bulletin: Multiple security vulnerabilities affect IBM Robotic Process Automation

Summary Python, Apache Spark, Tensorflow and Traefik contain multiple vulnerabilities and are used by IBM Robotic Process Automation as part of Watson NLP CVE-2022-40898, CVE-2023-22946, CVE-2023-25658, CVE-2023-25659, CVE-2023-25660, CVE-2023-25661, CVE-2023-25662, CVE-2023-25663, CVE-2023-25664...

CVE-2023-2253 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, kubernetes-dashboard, bom, aactl, kpt...

CVE-2023-2253 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard, kpt, argocd-image-updater-fips, argocd-image-updater, aactl, bom...

GHSA-HQXW-F8MX-CPMW vulnerabilities

Vulnerabilities for packages: argocd-image-updater, kubernetes-dashboard, bom, aactl, kpt...

GHSA-HQXW-F8MX-CPMW vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard, kpt, argocd-image-updater-fips, argocd-image-updater, aactl, bom...

Denial Of Service (DoS)

traefik is vulnerable to Denial of Service DoS. The vulnerability exists in when parsing the HTTP headers that could allocate substantially more memory than required causing an application crash...

SUSE CVE-2023-29013

Traefik pronounced traffic is a modern HTTP reverse proxy and load balancer for deploying microservices. There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik. HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This...

CVE-2023-29013

Traefik pronounced traffic is a modern HTTP reverse proxy and load balancer for deploying microservices. There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik. HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This...

Design/Logic Flaw

Traefik pronounced traffic is a modern HTTP reverse proxy and load balancer for deploying microservices. There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik. HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This...