CVE catalog
CVE-2023-54365
Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2
- Severity
- High · CVSS 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.77% · Oct 25, 2026
A flaw was found in Traefik's HTTP/2 request handling. A remote attacker can exploit this vulnerability by rapidly creating and canceling HTTP/2 streams. This can exhaust server resources, leading to a denial of service (DoS) and making the service unavailable to legitimate users. This issue is inherited from the Go standard library's HTTP/2 implementation, known as the 'Rapid Reset' technique. github.com/traefik/traefik: net/http2: Traefik: Denial of Service via HTTP/2 Rapid Reset technique The vulnerability is not caused by Traefik-specific code. Traefik was affected because it depended on a vulnerable version of Go's HTTP/2 implementation from the golang.org/x/net module. The remediation was to update dependencies to a version containing the upstream fix. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | traefik | Not reported | 2.10.5 | fixed |
| Cpe | traefik | Not reported | Not reported | unknown |
| Cpe | go | Not reported | 1.20.10 | fixed |
| Cpe | go | Not reported | 1.21.3 | fixed |
| Cpe | openshift_ai | Not reported | Not reported | unknown |
| Go | github.com/traefik/traefik | Not reported | 3.0.0-beta4 | fixed |
| Cpe | traefik | Not reported | Not reported | unknown |
| Cpe | go | Not reported | 1.21.3 | fixed |
| Cpe | openshift_ai | Not reported | Not reported | unknown |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | traefik | cpe | Not reported | 2.10.5 | Not reported | Not reported | Not reported |
| Cpe | go | cpe | Not reported | 1.20.10 | Not reported | Not reported | Not reported |
| Cpe | go | cpe | Not reported | 1.21.3 | Not reported | Not reported | Not reported |
| Go | github.com/traefik/traefik | go | Not reported | 3.0.0-beta4 | Not reported | GHSA-7V4P-328V-8V5G | Not reported |
| Cpe | go | cpe | Not reported | 1.21.3 | Not reported | NVD-CVE-2023-54365 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://github.com/advisories/GHSA-7v4p-328v-8v5g]
- [https://nvd.nist.gov/vuln/detail/CVE-2023-54365]
- [https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54365.json]
[FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]