CVE-2023-54365

Analyzed Analyzed - Analysis Complete

HTTP/2 Rapid Reset DoS in Traefik

Publication date: 2026-06-23

Last updated on: 2026-07-13

Assigner: VulnCheck

Description

Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' technique). A remote attacker can rapidly create and cancel HTTP/2 streams to exhaust server resources and cause service unavailability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-23

Last Modified

2026-07-13

Generated

2026-07-14

AI Q&A

2026-06-23

EPSS Evaluated

2026-07-12

NVD

CVE-2023-54365

EUVD

EUVD-2023-60596

Affected Vendors & Products

Vendor	Product	Version / Range
traefik	traefik	3.0.0
traefik	traefik	3.0.0
traefik	traefik	3.0.0
traefik	traefik	to 2.10.5 (exc)
golang	go	From 1.21.0 (inc) to 1.21.3 (exc)
golang	go	to 1.20.10 (exc)
redhat	openshift_ai	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

CVE-2023-54365 is a denial-of-service (DoS) vulnerability affecting Traefik, a popular reverse proxy and load balancer. It stems from the Go programming language's HTTP/2 request handling implementation. Specifically, the vulnerability allows a remote attacker to rapidly create and cancel HTTP/2 streams using the 'Rapid Reset' technique, which exhausts server resources.

This issue affects Traefik versions before 2.10.5 and 3.0.0-beta4, as well as certain Go versions. There are no known workarounds, and the recommended mitigation is to upgrade to the patched versions.

Impact Analysis

This vulnerability can be exploited by a remote attacker to cause a denial of service on affected Traefik servers. By rapidly creating and canceling HTTP/2 streams, the attacker can exhaust server resources, leading to service unavailability.

The impact is a disruption of normal service operations, potentially causing downtime and affecting the availability of applications or services relying on Traefik.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Traefik to the patched versions that address this issue.

Upgrade Traefik to version 2.10.5 or later.
If using beta versions, upgrade to Traefik 3.0.0-beta4 or later.

There are no known workarounds for this vulnerability, so upgrading is the recommended immediate action.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2023-54365. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70