CVE-2023-54365High· 7.5▾ Twilight

Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' techniqu…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.2 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jun 23, 2026

Updated

Sep 26, 2026

CVSS

7.5

Vendor

traefik

Product

traefik

CWE

CWE-400, CWE-770

Depth score

41 · Moderate

EPSS

0.77% · p56

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Jul 30.

0.6% → 0.8%▲ 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

6 events · 95 days

Jun 23, 2026Published
Disclosed via NVD
Jul 30, 2026EPSS first tracked
0.6%
Aug 24, 2026EPSS peak
0.6% → 0.8%
Sep 22, 2026CVSS changed
— → 7.5
Sep 22, 2026Severity changed
medium → high
Sep 26, 2026Record revised
Last analysed / modified upstream

traefik CWE-400 CWE-770 #nvd #osv #go #ghsa

Affected

traefik < 2.10.5
traefik = 3.0.0
go < 1.20.10
go >= 1.21.0, < 1.21.3
openshift_ai

Patched in

traefik 2.10.5
go 1.21.3

Full technical detail▾

Overview

Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' technique). A remote attacker can rapidly create and cancel HTTP/2 streams to exhaust server resources and cause service unavailability.

Affected

traefik < 2.10.5
traefik = 3.0.0
go < 1.20.10
go >= 1.21.0, < 1.21.3
openshift_ai

Remediation

Upgrade past the affected range:

traefik 2.10.5
go 1.21.3

Package advisory (CVE-2023-54365)

Affected packages:

github.com/traefik/traefik < 2.10.5
github.com/traefik/traefik >= 3.0.0-beta1, < 3.0.0-beta4

Patched in:

github.com/traefik/traefik 2.10.5
github.com/traefik/traefik 3.0.0-beta4

Source: https://osv.dev/vulnerability/GHSA-7v4p-328v-8v5g

References

Change history

Field changes observed since this record was first indexed.

Sep 22, 2026CVSS — → 7.5
Sep 22, 2026Severity medium → high

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#osv#go#ghsa

← Back to feed

CVE-2023-54365High· 7.5▾ Twilight

Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' techniqu…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.2 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jun 23, 2026

Updated

Sep 26, 2026

CVSS

7.5

Vendor

traefik

Product

traefik

CWE

CWE-400, CWE-770

Depth score

41 · Moderate

EPSS

0.77% · p56

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Jul 30.

0.6% → 0.8%▲ 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

6 events · 95 days

Jun 23, 2026Published
Disclosed via NVD
Jul 30, 2026EPSS first tracked
0.6%
Aug 24, 2026EPSS peak
0.6% → 0.8%
Sep 22, 2026CVSS changed
— → 7.5
Sep 22, 2026Severity changed
medium → high
Sep 26, 2026Record revised
Last analysed / modified upstream

traefik CWE-400 CWE-770 #nvd #osv #go #ghsa

Affected

traefik < 2.10.5
traefik = 3.0.0
go < 1.20.10
go >= 1.21.0, < 1.21.3
openshift_ai

Patched in

traefik 2.10.5
go 1.21.3

Full technical detail▾

Overview

Affected

traefik < 2.10.5
traefik = 3.0.0
go < 1.20.10
go >= 1.21.0, < 1.21.3
openshift_ai

Remediation

Upgrade past the affected range:

traefik 2.10.5
go 1.21.3

Package advisory (CVE-2023-54365)

Affected packages:

github.com/traefik/traefik < 2.10.5
github.com/traefik/traefik >= 3.0.0-beta1, < 3.0.0-beta4

Patched in:

github.com/traefik/traefik 2.10.5
github.com/traefik/traefik 3.0.0-beta4

Source: https://osv.dev/vulnerability/GHSA-7v4p-328v-8v5g

References

Change history

Field changes observed since this record was first indexed.

Sep 22, 2026CVSS — → 7.5
Sep 22, 2026Severity medium → high

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#osv#go#ghsa