logo

Database

Asymmetric denial of service In github.com/traefik/traefik/v2

Description

Traefik HTTP/2 connections management could cause a denial of service

Impact

There is a potential vulnerability in Traefik managing HTTP/2 connections. A closing HTTP/2 server connection could hang forever because of a subsequent fatal error. This failure mode could be exploited to cause a denial of service.

Patches

Traefik v2.8.x: https://github.com/traefik/traefik/releases/tag/v2.8.8 Traefik v2.9.x: https://github.com/traefik/traefik/releases/tag/v2.9.0-rc5

Workarounds

No workaround.

For more information

If you have any questions or comments about this advisory, please open an issue.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2022-392712. NVD-2022-392713. OSV-2022-392714. GHSA-c6hx-pjc3-7fqr5. GCVE-2022-39271

References

1. https://github.com/traefik/traefik/security/advisories/GHSA-c6hx-pjc3-7fqr2. https://github.com/traefik/traefik/releases/tag/v2.8.83. https://github.com/traefik/traefik/releases/tag/v2.9.0-rc5

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.