CVE-2023-47633: Traefik Docker Container CPU Exhaustion
Summary
CVE-2023-47633: Traefik docker container using 100% CPU. Affects github.com/traefik/traefik/v2 versions < 2.10.6. Fixed in 2.10.6. How to fix ↓
Also tracked for
The same CVE-2023-47633 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Traefik is an open-source reverse proxy and load balancer that is designed for microservices and containerized applications. It provides automatic discovery and configuration for services running in Docker containers. The vulnerability in Traefik allows an attacker to cause the Docker container to use 100% CPU, resulting in server unresponsiveness. This vulnerability affects versions 2.x and 3.x of the Traefik package.
Vulnerability Detail
The vulnerability arises when Traefik serves as its own backend, which is an automatically generated route resulting from the Docker integration in the default configuration. By sending a request with the hostname of the Traefik container, an endless loop of requests is triggered, causing the server to become unreachable and utilizing 100% CPU. This vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: v2.11.60 as of 22 Oct 2026
go get github.com/traefik/traefik/v2@v2.11.60Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.10.6
This is the first release that contains the fix.
go get github.com/traefik/traefik/v2@v2.10.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, you can avoid using Traefik as its own backend. This can be achieved by modifying the Traefik configuration to exclude the self-referencing route. Additionally, you can consider using an alternative reverse proxy or load balancer until the updated version of Traefik is available.
Conclusion
The Traefik Docker container CPU exhaustion vulnerability can lead to server unresponsiveness and service disruption. It is crucial to update the Traefik package to the recommended versions to mitigate this vulnerability. If you require further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for github.com/traefik/traefik/v2 →
FAQ
Traefik is an open-source reverse proxy and load balancer designed for microservices and containerized applications. It provides automatic discovery and configuration for services running in Docker containers.
The vulnerability causes the Traefik Docker container to use 100% CPU, resulting in server unresponsiveness. This can lead to service disruption and denial of service.
Versions 2.x and 3.x of the Traefik package are affected by this vulnerability.
To fix this vulnerability, update the Traefik package to version 2.10.6 for version 2.x or version 3.0.0-beta5 for version 3.x. Follow the standard update procedure for your package manager or manually download and install the updated version from the official Traefik repository.
As a workaround, you can modify the Traefik configuration to exclude the self-referencing route. Alternatively, you can consider using an alternative reverse proxy or load balancer until the updated version of Traefik is available.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/traefik/traefik/v2.
