Traefik Vulnerability: Malformed DNS Message Denial of Service
Summary
GHSA-f7cq-5v43-8pwp: Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop. Affects github.com/traefik/traefik/v2 versions < 2.11.3. Fixed in 2.11.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Traefik is an open-source reverse proxy and load balancer that is designed for microservices and containerized applications. It provides routing, SSL/TLS termination, and other essential features for managing web traffic. However, Traefik is vulnerable to a specific issue in the GO programming language that allows malformed DNS messages to cause an infinite loop. This vulnerability can be exploited to launch a denial of service attack against Traefik.
Vulnerability Detail
The vulnerability in Traefik arises from a flaw in the GO programming language's handling of malformed DNS messages. An attacker can send a specially crafted DNS message to Traefik, triggering an infinite loop that consumes excessive CPU resources and leads to a denial of service. This can disrupt the normal operation of Traefik and impact the availability of services relying on it. The vulnerability has been assigned the CVE identifier CVE-2024-24788.
How To Fix
Latest published version: v2.11.60 as of 22 Oct 2026
go get github.com/traefik/traefik/v2@v2.11.60Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.3
This is the first release that contains the fix.
go get github.com/traefik/traefik/v2@v2.11.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the provided patches or update to a patched version of Traefik to address the issue.
Conclusion
The vulnerability in Traefik that allows malformed DNS messages to cause a denial of service can be mitigated by updating to the patched versions of Traefik (v2.11.3 or v3.0.1). It is crucial for users of Traefik to apply these patches to ensure the security and availability of their services. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/traefik/traefik/v2 →
FAQ
Traefik is an open-source reverse proxy and load balancer designed for microservices and containerized applications. It provides essential features for managing web traffic, including routing and SSL/TLS termination.
The vulnerability allows an attacker to launch a denial of service attack against Traefik by sending malformed DNS messages. This can disrupt the normal operation of Traefik and impact the availability of services relying on it.
To fix this vulnerability, update your Traefik installation to either version 2.11.3 or version 3.0.1. These versions contain patches that address the issue.
No, there is no known workaround for this vulnerability. It is recommended to apply the provided patches or update to a patched version of Traefik.
For more information, you can refer to the official advisory and CVE record linked in the vulnerability details section.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/traefik/traefik/v2.
