You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
See doc/triage.md for instructions on how to triage this report.
modules:
- module: github.com/traefik/traefik/v2
versions:
- introduced: TODO (earliest fixed "2.10.0-rc2", vuln range "= 2.10.0-rc1")
packages:
- package: github.com/traefik/traefik/v2
- module: github.com/traefik/traefik/v2
versions:
- fixed: 2.9.10
packages:
- package: github.com/traefik/traefik/v2
summary: 'Traefik HTTP header parsing could cause a denial of service '
description: |
### Impact
There is a vulnerability in [Go when parsing the HTTP headers](https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8/m/OV40vnafAwAJ), which impacts Traefik.
HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This behavior could be exploited to cause a denial of service.
### References
- [CVE-2023-24534](https://www.cve.org/CVERecord?id=CVE-2023-24534)
### Patches
- https://github.com/traefik/traefik/releases/tag/v2.9.10
- https://github.com/traefik/traefik/releases/tag/v2.10.0-rc2
### Workarounds
No workaround.
### For more information
If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).
cves:
- CVE-2023-29013
ghsas:
- GHSA-7hj9-rv74-5g92
references:
- advisory: https://github.com/traefik/traefik/security/advisories/GHSA-7hj9-rv74-5g92
- fix: https://github.com/traefik/traefik/commit/4ed3964b3586565519249bbdc55eb1b961c08c49
- advisory: https://github.com/advisories/GHSA-8v5j-pwr7-w5f8
- web: https://github.com/traefik/traefik/releases/tag/v2.10.0-rc2
- web: https://github.com/traefik/traefik/releases/tag/v2.9.10
- web: https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8/m/OV40vnafAwAJ
- advisory: https://github.com/advisories/GHSA-7hj9-rv74-5g92
The text was updated successfully, but these errors were encountered:
In GitHub Security Advisory GHSA-7hj9-rv74-5g92, there is a vulnerability in the following Go packages or modules:
Cross references:
See doc/triage.md for instructions on how to triage this report.
The text was updated successfully, but these errors were encountered: