p PatchFirst

CVE-2024-39321

CVE-2024-39321 · Traefik vulnerable to bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Traefik is an HTTP reverse proxy and load balancer. Versions prior to 2.11.6, 3.0.4, and 3.1.0-rc3 have a vulnerability that allows bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes sent with spoofed IP addresses. Versions 2.11.6, 3.0.4, and 3.1.0-rc3 contain a patch for this issue. No known workarounds are available.

CVSS 7.5 · High · EPSS 0.6%

Published
Updated

Stack: web

Affected products and versions

  • traefik

    Versions
    • < 2.11.6: Affected
    • >= 3.0.0-beta3, < 3.0.4: Affected
    • >= 3.1.0-rc1, < 3.1.0-rc3: Affected

    No fix published

Original sources

Check your server →