Traefik vulnerable to potential DDoS via ACME HTTPChallenge

Impact There is a potential vulnerability in Traefik managing the ACME HTTP challenge. When Traefik is configured to use the HTTPChallenge to generate and renew the Let's Encrypt TLS certificates, the delay authorized to solve the challenge 50 seconds can be exploited by attackers slowloris attac...

GHSA-8G85-WHQH-CR2F vulnerabilities

Vulnerabilities for packages: traefik...

GHSA-FVHJ-4QFH-Q2HM vulnerabilities

Vulnerabilities for packages: traefik...

GHSA-FVHJ-4QFH-Q2HM vulnerabilities

Vulnerabilities for packages: traefik...

GHSA-FVHJ-4QFH-Q2HM Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass

Summary When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates the RFC because in the origin-form the URL should only contain the absolute path and the query. When this is combined with another fronte...

Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass

Summary When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates the RFC because in the origin-form the URL should only contain the absolute path and the query. When this is combined with another fronte...

Denial Of Service (DoS)

github.com/traefik/traefik is vulnerable to is vulnerable to Denial Of Service DoS. The vulnerability exists due to improper default route configuration when traefik is ran using docker, allowing an attacker to crash the application if they know the name of the running container...

Authorization Bypass

github.com/traefik/traefik is vulnerable to Authorization Bypass. This vulnerability arises because Traefik automatically encodes and forwards URL fragments to backend servers, violating protocol standards and potentially bypassing security controls implemented by frontend proxies like NGINX. An...

Denial Of Service (DoS)

github.com/traefik/traefik is vulnerable to Denial of Service DoS. The vulnerability occurs when using the HTTPChallenge method for Lets Encrypt certificate renewals. The vulnerability exploits a 50-second window during the challenge validation process, allowing attackers to bombard the system wi...

CVE-2023-47633 vulnerabilities

Vulnerabilities for packages: traefik...

CVE-2023-47633 vulnerabilities

Vulnerabilities for packages: traefik...

CVE-2023-47633

Traefik is an open source HTTP reverse proxy and load balancer. The traefik docker container uses 100% CPU when it serves as its own backend, which is an automatically generated route resulting from the Docker integration in the default configuration. This issue has been addressed in versions...

CVE-2023-47633

Traefik is an open source HTTP reverse proxy and load balancer. The traefik docker container uses 100% CPU when it serves as its own backend, which is an automatically generated route resulting from the Docker integration in the default configuration. This issue has been addressed in versions...

CVE-2023-47124 vulnerabilities

Vulnerabilities for packages: traefik...

CVE-2023-47106

Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path...

CVE-2023-47124 vulnerabilities

Vulnerabilities for packages: traefik...

CVE-2023-47124

Traefik is an open source HTTP reverse proxy and load balancer. When Traefik is configured to use the HTTPChallenge to generate and renew the Let's Encrypt TLS certificates, the delay authorized to solve the challenge 50 seconds can be exploited by attackers to achieve a slowloris attack. This...

CVE-2023-47106 vulnerabilities

Vulnerabilities for packages: traefik...

CVE-2023-47106 vulnerabilities

Vulnerabilities for packages: traefik...

CVE-2023-47106

Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path...