5.9Media

CVE-2026-119574Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service

traefik traefik Publicada: 2026-10-30 16:18 (hace 15 días)

Descripción

Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connections such as WebSocket, corrupting the unsynchronized shared bufio.Reader and triggering an unrecovered panic that terminates Traefik.

Debilidad (CWE): CWE-567

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
traefik	traefik	3.2.0 – < 3.7.15, fixed 3.7.15

Referencias y parches

GitHub Security Advisory (GHSA-ww7c-q3mv-xx22) vendor-advisoryPatchVendor Advisory
VulnCheck Advisory: Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service third-party-advisoryThird Party Advisory

Coincidencias CPE (NVD) (1)

cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* ≥ 3.2.0 < 3.7.15

Puntuación CVSS

5.9Media

Fuente: VulnCheck · CVSS 3.1

Vector de ataque: Red
Complejidad: Alta
Privilegios: Ninguno
Interacción del usuario: Ninguna
Alcance: Sin cambio
Confidencialidad: Ninguno
Integridad: Ninguno
Disponibilidad: Alto

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Todas las puntuaciones (4)

cna	CVSS 4.0	8.2Alta
cna	CVSS 3.1	5.9Media
disclosure@vulncheck.com	CVSS 4.0	8.2Alta
disclosure@vulncheck.com	CVSS 3.1	5.9Media

EPSS (probabilidad de explotación en 30 días)

0.28%

superior al 21 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: none
Automatizable: no
Impacto técnico: partial

Cronología

ID reservado2026-10-30
Publicada2026-10-30 16:18
Llegó a IP-DB2026-10-30 17:03
Última actualización2026-11-03 17:04

Asignada por (CNA): VulnCheck
Estado en NVD: Analyzed

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — Traefik

8.7Alta

CVE-2026-121966 hace 10 días

Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak

traefik traefik

Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthen…

4.4Media

CVE-2026-119573 hace 15 días

Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret

traefik traefik

Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users who can create Ingres…

8.7Alta

CVE-2026-119572 hace 15 días

Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider

traefik traefik

Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation. When another Ingress declares a path on the same host wit…

7.5Alta

CVE-2026-114656 hace 23 días

Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher

traefik traefik

Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by Requ…

8.7Alta

CVE-2026-114642 hace 23 días

Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper

traefik traefik

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticat…

3.7Baja

CVE-2026-114641 hace 23 días

Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper

traefik traefik

Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send co…