CVE-2026-26998
Unrestricted Memory Allocation in Traefik ForwardAuth Causes DoS
Publication date: 2026-03-05
Last updated on: 2026-03-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| traefik | traefik | to 2.11.38 (exc) |
| traefik | traefik | From 3.0.0 (inc) to 3.6.9 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability can cause a denial of service by crashing the Traefik process due to out-of-memory conditions. This means all routes served by the affected Traefik instance become unavailable.
- A remote attacker with high privileges can trigger this by sending a single HTTP request through a ForwardAuth-protected route.
- In multi-tenant environments, tenants controlling their own ForwardAuth endpoints or compromised authentication servers returning large responses can cause Traefik to consume excessive memory and crash.
Overall, this leads to a complete outage of Traefik services, impacting availability.
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "This vulnerability exists in Traefik's ForwardAuth middleware prior to versions 2.11.38 and 3.6.9. When Traefik is configured to use ForwardAuth, it reads the entire response body from the authentication server into memory without any size limit. Because there is no configuration option to restrict the maximum response body size, if the authentication server returns an unexpectedly large or infinite response, Traefik will allocate unlimited memory."}, {'type': 'paragraph', 'content': 'This unbounded memory allocation can cause Traefik to run out of memory (OOM), crashing the process and resulting in a denial of service for all routes served by that Traefik instance.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring the Traefik process for out-of-memory (OOM) crashes, especially if Traefik is configured with the ForwardAuth middleware. A sudden Traefik crash with exit code 137 (OOM killed) and unavailability of all routes served by Traefik may indicate exploitation of this issue.'}, {'type': 'paragraph', 'content': 'To detect if your Traefik instance is vulnerable, check the version of Traefik running. Versions prior to 2.11.38 and 3.6.9 are affected.'}, {'type': 'paragraph', 'content': 'You can also inspect Traefik logs for unusual memory usage or crashes related to ForwardAuth middleware.'}, {'type': 'paragraph', 'content': 'Suggested commands include:'}, {'type': 'list_item', 'content': 'Check Traefik version: `traefik version`'}, {'type': 'list_item', 'content': 'Monitor Traefik process memory usage: `ps aux | grep traefik` or `top -p $(pidof traefik)`'}, {'type': 'list_item', 'content': "Check for OOM kills in system logs: `dmesg | grep -i 'killed process'` or `journalctl -xe | grep -i 'oom'`"}, {'type': 'list_item', 'content': 'Review Traefik logs for ForwardAuth errors or crashes.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Traefik to a patched version: at least version 2.11.38 or 3.6.9, where the vulnerability has been fixed.
If upgrading is not immediately possible, consider disabling the ForwardAuth middleware or restricting access to trusted authentication servers to prevent malicious or large response bodies.
Monitor Traefik for unusual memory consumption and crashes, and restart the service if necessary.
In the long term, apply configuration or code changes that limit the size of the authentication server response body, such as applying `io.LimitReader` or a similar mechanism to prevent unbounded memory allocation.