Traefik HTTP/2 connections management could cause a denial of service

CAO 7.5CVE-2022-39271 · GHSA-c6hx-pjc3-7fqr · Công bố 11/10/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-39271 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng github.com/traefik/traefik/v2, traefik (traefik).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.4%, cao hơn 71.7% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.9.0-rc5, 2.8.8 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/traefik/traefik/v2 Go	`≥ 2.9.0-rc1, < 2.9.0-rc5< 2.8.8`	`2.9.0-rc52.8.8`
traefik traefik	`= 2.9.0< 2.8.8`	`2.8.8`

Mô tả

Impact

There is a potential vulnerability in Traefik managing HTTP/2 connections. A closing HTTP/2 server connection could hang forever because of a subsequent fatal error. This failure mode could be exploited to cause a denial of service.

Patches

Traefik v2.8.x: https://github.com/traefik/traefik/releases/tag/v2.8.8 Traefik v2.9.x: https://github.com/traefik/traefik/releases/tag/v2.9.0-rc5

Workarounds

No workaround.

For more information

If you have any questions or comments about this advisory, please open an issue.

Mô tả của NVD

Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that assists in deploying microservices. There is a potential vulnerability in Traefik managing HTTP/2 connections. A closing HTTP/2 server connection could hang forever because of a subsequent fatal error. This failure mode could be exploited to cause a denial of service. There has been a patch released in versions 2.8.8 and 2.9.0-rc5. There are currently no known workarounds.