GHSA-hxr6-2p24-hf98 Traefik affected by CVE-2024-53259

Not scored Published 17 Dec 2024

Traefik is vulnerable to a denial of service attack via HTTP/3 connections, requiring an upgrade to patched versions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-hxr6-2p24-hf98?

GHSA-hxr6-2p24-hf98 is a denial of service vulnerability in github.com/traefik/traefik, published on 17 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

There is a potential vulnerability in Traefik managing HTTP/3 connections.

More details in the CVE-2024-53259.

Patches

Workarounds

No workaround

For more information

If you have any questions or comments about this advisory, please open an issue.

Which versions are affected by GHSA-hxr6-2p24-hf98?

7 open source packages ship an affected version, including github.com/traefik/traefik/v2, github.com/traefik/traefik and github.com/traefik/traefik/v3.

Package	Affected	Fixed in
`github.com/traefik/traefik/v2` Go	All versions	`2.11.15`
`github.com/traefik/traefik/v2` Go	All versions	`2.11.15`
`github.com/traefik/traefik/v2` Go	All versions	`2.11.15`
`github.com/traefik/traefik` Go	All versions	None
`github.com/traefik/traefik/v3` Go	All versions	`3.2.2`
`github.com/traefik/traefik/v3` Go	All versions	`3.2.2`

1 more packages

github.com/traefik/traefik/v3 Go All versions 3.2.2

How do I fix GHSA-hxr6-2p24-hf98?

Upgrade github.com/traefik/traefik/v2 to 2.11.15 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is GHSA-hxr6-2p24-hf98 being exploited?

There is no known exploitation of GHSA-hxr6-2p24-hf98 in the wild and no public exploit code.

Sources

Also known as GO-2024-3342.