CVE-2023-29013

Katalog CVE

CVSS 7.5 · High EPSS 1,1%

Kerentanan Uncontrolled Resource Consumption pada traefik. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices. There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik. HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This behavior could be exploited to cause a denial of service. This issue has been patched in versions 2.9.10 and 2.10.0-rc2.

Rincian

Terbit di NVD

14 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/traefik/traefik/security/advisories/GHSA-7hj9-rv74-5g92 advisory vendor
• https://github.com/traefik/traefik/commit/4ed3964b3586565519249bbdc55eb1b961c08c49 patch
• https://security.netapp.com/advisory/ntap-20230517-0008/ advisory pihak ketiga
• https://github.com/traefik/traefik/releases/tag/v2.10.0-rc2 release notes
• https://github.com/traefik/traefik/releases/tag/v2.9.10 release notes