CVE-2023-54365

Katalog CVE

CVSS 7.5 · High EPSS 0,77%

Kerentanan Uncontrolled Resource Consumption pada traefik, golang go +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' technique). A remote attacker can rapidly create and cancel HTTP/2 streams to exhaust server resources and cause service unavailability.

Rincian

Terbit di NVD

23 Juni 2026

Terakhir diubah

26 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,77% peluang dieksploitasi; lebih tinggi dari 54,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/traefik/traefik/security/advisories/GHSA-7v4p-328v-8v5g patch · advisory vendor
• https://www.vulncheck.com/advisories/traefik-denial-of-service-via-http-2-request-handling advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2023-54365 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2491710 advisory pihak ketiga
• https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54365.json advisory pihak ketiga