Traefik HTTP/2 CONTINUATION Flood Vulnerability
Summary
GHSA-7f4j-64p6-5h5v: Traefik affected by HTTP/2 CONTINUATION flood in net/http. Affects github.com/traefik/traefik/v2 versions < 2.11.2. Fixed in 2.11.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Traefik is an open-source reverse proxy and load balancer that is designed for microservices and containerized applications. It provides routing, SSL/TLS termination, and traffic management capabilities. Traefik supports HTTP/2 connections, which allow for improved performance and efficiency. However, a vulnerability has been discovered in Traefik's handling of HTTP/2 connections, specifically related to HTTP/2 CONTINUATION frames.
Vulnerability Detail
The vulnerability in Traefik arises from a potential HTTP/2 CONTINUATION flood in the net/http package. An attacker could exploit this vulnerability by sending a large number of HTTP/2 CONTINUATION frames, overwhelming the server and causing a denial-of-service (DoS) condition. This could lead to service disruption and potentially impact the availability of the affected Traefik instance. The vulnerability has been assigned the CVE identifier CVE-2023-45288.
How To Fix
Latest published version: v2.11.60 as of 22 Oct 2026
go get github.com/traefik/traefik/v2@v2.11.60Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.2
This is the first release that contains the fix.
go get github.com/traefik/traefik/v2@v2.11.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the patched versions mentioned above.
Conclusion
The HTTP/2 CONTINUATION flood vulnerability in Traefik can be mitigated by updating to the latest patched versions. It is crucial to keep Traefik up to date to ensure the security and stability of your deployments. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/traefik/traefik/v2 →
FAQ
Traefik is an open-source reverse proxy and load balancer designed for microservices and containerized applications. It provides routing, SSL/TLS termination, and traffic management capabilities.
The vulnerability allows for a potential denial-of-service (DoS) attack, which could result in service disruption and impact the availability of the affected Traefik instance.
To fix this vulnerability, it is recommended to update Traefik to the latest patched versions: Traefik v2.11.2 or Traefik v3.0.0-rc5.
No, there is no known workaround for this vulnerability. Updating to the patched versions is the recommended solution.
For more information, you can refer to the official advisory and the CVE record: https://github.com/traefik/traefik/issues https://www.cve.org/CVERecord?id=CVE-2023-45288
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/traefik/traefik/v2.
