CVE-2023-54365: Traefik - Denial of Service via HTTP/2 Request Handling
Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' technique). A remote attacker can rapidly create and cancel HTTP/2 streams to exhaust server resources and cause service unavailability.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-54365?
The severity of CVE-2023-54365 is high with a score of 7.5.
How do I fix CVE-2023-54365?
To fix CVE-2023-54365, upgrade Traefik to version 2.10.5 or 3.0.0-beta4 or later.
What type of vulnerability is CVE-2023-54365?
CVE-2023-54365 is a denial-of-service vulnerability affecting HTTP/2 request handling.
Who is affected by CVE-2023-54365?
CVE-2023-54365 affects users of Traefik versions prior to 2.10.5 and 3.0.0-beta4.
Can CVE-2023-54365 be exploited remotely?
Yes, CVE-2023-54365 can be exploited remotely by attackers using the HTTP/2 protocol.