{"id":"CVE-2026-119574","title":"Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service","summary":"Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connecti…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-567"],"vendor":"traefik","product":"traefik","affected":["traefik >= 3.2.0 < 3.7.15"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T15:17:03.547846Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T15:17:13.625Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119574","references":[{"url":"https://github.com/traefik/traefik/security/advisories/GHSA-ww7c-q3mv-xx22","label":"GitHub Security Advisory (GHSA-ww7c-q3mv-xx22)"},{"url":"https://www.vulncheck.com/advisories/traefik-3.2.0-before-3.7.15-fastproxy-data-race-denial-of-service","label":"VulnCheck Advisory: Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service"}],"tags":["cve.org"],"epss":0.00284,"epssPercentile":0.21009,"ingestedAt":"2026-11-05T16:07:30.402Z","slug":"CVE-2026-119574","body":"## Overview\n\nTraefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connections such as WebSocket, corrupting the unsynchronized shared bufio.Reader and triggering an unrecovered panic that terminates Traefik.\n\n## Affected\n\n- `traefik >= 3.2.0 < 3.7.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}