GHSA-4hjq-9h5c-252j Traefik: HTTP/2 frames can cause a running server to panic

Not scored Published 12 Mar 2026

Traefik server panics when processing malicious HTTP/2 frames, causing a denial of service for administrators running the proxy.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-4hjq-9h5c-252j?

GHSA-4hjq-9h5c-252j is a denial of service vulnerability in github.com/traefik/traefik, published on 12 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Summary

More Details:

Patches

For more information

If you have any questions or comments about this advisory, please open an issue.

Which versions are affected by GHSA-4hjq-9h5c-252j?

7 open source packages ship an affected version, including github.com/traefik/traefik/v2, github.com/traefik/traefik and github.com/traefik/traefik/v3.

Package	Affected	Fixed in
`github.com/traefik/traefik/v2` Go	All versions	`2.11.40`
`github.com/traefik/traefik/v2` Go	All versions	`2.11.40`
`github.com/traefik/traefik/v2` Go	All versions	`2.11.40`
`github.com/traefik/traefik` Go	All versions	None
`github.com/traefik/traefik/v3` Go	All versions	`3.6.10`
`github.com/traefik/traefik/v3` Go	All versions	`3.6.10`

1 more packages

github.com/traefik/traefik/v3 Go All versions 3.6.10

How do I fix GHSA-4hjq-9h5c-252j?

Upgrade github.com/traefik/traefik/v2 to 2.11.40 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is GHSA-4hjq-9h5c-252j being exploited?

There is no known exploitation of GHSA-4hjq-9h5c-252j in the wild and no public exploit code.

Sources

Also known as GO-2026-4684.