Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices. There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik. HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This behavior could be exploited to cause a denial of service. This issue has been patched in versions 2.9.10 and 2.10.0-rc2.
References
| Link | Resource |
|---|---|
| https://github.com/traefik/traefik/commit/4ed3964b3586565519249bbdc55eb1b961c08c49 | Patch |
| https://github.com/traefik/traefik/commit/4ed3964b3586565519249bbdc55eb1b961c08c49 | Patch |
| https://github.com/traefik/traefik/releases/tag/v2.10.0-rc2 | Release Notes |
| https://github.com/traefik/traefik/releases/tag/v2.10.0-rc2 | Release Notes |
| https://github.com/traefik/traefik/releases/tag/v2.9.10 | Release Notes |
| https://github.com/traefik/traefik/releases/tag/v2.9.10 | Release Notes |
| https://github.com/traefik/traefik/security/advisories/GHSA-7hj9-rv74-5g92 | Vendor Advisory |
| https://github.com/traefik/traefik/security/advisories/GHSA-7hj9-rv74-5g92 | Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20230517-0008/ | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20230517-0008/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
13 Feb 2025, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://security.netapp.com/advisory/ntap-20230517-0008/ - Third Party Advisory | |
| References | () https://github.com/traefik/traefik/security/advisories/GHSA-7hj9-rv74-5g92 - Vendor Advisory | |
| References | () https://github.com/traefik/traefik/commit/4ed3964b3586565519249bbdc55eb1b961c08c49 - Patch | |
| References | () https://github.com/traefik/traefik/releases/tag/v2.10.0-rc2 - Release Notes | |
| References | () https://github.com/traefik/traefik/releases/tag/v2.9.10 - Release Notes | |
| Summary | Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices. There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik. HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This behavior could be exploited to cause a denial of service. This issue has been patched in versions 2.9.10 and 2.10.0-rc2. |
26 May 2023, 15:01
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | ||
| References | (MISC) https://security.netapp.com/advisory/ntap-20230517-0008/ - Third Party Advisory |
17 May 2023, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
25 Apr 2023, 16:06
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| First Time |
Traefik traefik
Traefik Golang go Golang |
|
| CPE | cpe:2.3:a:golang:go:1.20.2:*:*:*:*:*:*:* cpe:2.3:a:traefik:traefik:2.10.0:rc1:*:*:*:*:*:* cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* |
|
| References | (MISC) https://github.com/traefik/traefik/commit/4ed3964b3586565519249bbdc55eb1b961c08c49 - Patch | |
| References | (MISC) https://github.com/traefik/traefik/security/advisories/GHSA-7hj9-rv74-5g92 - Vendor Advisory | |
| References | (MISC) https://github.com/traefik/traefik/releases/tag/v2.9.10 - Release Notes | |
| References | (MISC) https://github.com/traefik/traefik/releases/tag/v2.10.0-rc2 - Release Notes |
14 Apr 2023, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-14 19:15
Updated : 2025-02-13 17:16
NVD link : CVE-2023-29013
Mitre link : CVE-2023-29013
JSON object : View
Products Affected
traefik
- traefik
CWE
CWE-400
Uncontrolled Resource Consumption