CVE-2022-39271: falha de alta gravidade em traefik
Traefik HTTP/2 connections management could cause a denial of service
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 1.4%
Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that assists in deploying microservices. There is a potential vulnerability in Traefik managing HTTP/2 connections. A closing HTTP/2 server connection could hang forever because of a subsequent fatal error. This failure mode could be exploited to cause a denial of service. There has been a patch released in versions 2.8.8 and 2.9.0-rc5. There are currently no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
traefik · traefikCVEs relacionadas — traefik
No mesmo produto, das mais perigosas para as menos.
CVE-2026-85595CRITICALTraefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuthEPSS 2.5%CVE-2022-23632HIGHTraefik skips the router TLS configuration when the host header is an FQDNEPSS 1.7%CVE-2024-45410CRITICALHTTP client can remove the X-Forwarded headers in TraefikEPSS 1.5%CVE-2025-54386HIGHTraefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code ExecutionEPSS 1.4%CVE-2023-47633HIGHUncontrolled Resource Consumption in TraefikEPSS 1.3%CVE-2021-32813MEDIUMDrop Headers via Malicious Connection HeaderEPSS 1.1%