GHSA-7f4j-64p6-5h5v Traefik affected by HTTP/2 CONTINUATION flood in net/http

Not scored Published 15 Apr 2024

Traefik is vulnerable to HTTP/2 CONTINUATION flood attacks, allowing remote attackers to cause denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-7f4j-64p6-5h5v?

GHSA-7f4j-64p6-5h5v is a denial of service vulnerability in github.com/traefik/traefik, published on 15 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

There is a potential vulnerability in Traefik managing HTTP/2 connections.

More details in the CVE-2023-45288.

Patches

Workarounds

No workaround

For more information

If you have any questions or comments about this advisory, please open an issue.

Which versions are affected by GHSA-7f4j-64p6-5h5v?

7 open source packages ship an affected version, including github.com/traefik/traefik/v2, github.com/traefik/traefik and github.com/traefik/traefik/v3.

Package	Affected	Fixed in
`github.com/traefik/traefik/v2` Go	All versions	`2.11.2`
`github.com/traefik/traefik/v2` Go	All versions	`2.11.2`
`github.com/traefik/traefik/v2` Go	All versions	`2.11.2`
`github.com/traefik/traefik` Go	All versions	None
`github.com/traefik/traefik/v3` Go	From `3.0.0-rc1`	`3.0.0-rc5`
`github.com/traefik/traefik/v3` Go	From `3.0.0-rc1`	`3.0.0-rc5`

1 more packages

github.com/traefik/traefik/v3 Go From 3.0.0-rc1 3.0.0-rc5

How do I fix GHSA-7f4j-64p6-5h5v?

Upgrade github.com/traefik/traefik/v2 to 2.11.2 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is GHSA-7f4j-64p6-5h5v being exploited?

There is no known exploitation of GHSA-7f4j-64p6-5h5v in the wild and no public exploit code.

Sources

Also known as GO-2024-2726.