CVE-2023-29013
CVE-2023-29013 · HTTP header parsing could cause a deny of service
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices. There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik. HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This behavior could be exploited to cause a denial of service. This issue has been patched in versions 2.9.10 and 2.10.0-rc2.
CVSS 7.5 · High · EPSS 1.1%
- Published
- Updated
Stack: web
Affected products and versions
traefik
- Versions
- < 2.9.10: Affected
- = 2.10.0-rc1: Affected
No fix published
Original sources
- https://github.com/traefik/traefik/security/advisories/GHSA-7hj9-rv74-5g92
- https://github.com/traefik/traefik/commit/4ed3964b3586565519249bbdc55eb1b961c08c49
- https://github.com/traefik/traefik/releases/tag/v2.10.0-rc2
- https://github.com/traefik/traefik/releases/tag/v2.9.10
- https://security.netapp.com/advisory/ntap-20230517-0008/
- https://nvd.nist.gov/vuln/detail/CVE-2023-29013