Uncontrolled Resource Consumption in Traefik

Vulnerability

Description CVE-2023-47633 affects Traefik, an open-source HTTP reverse proxy and load balancer. The root cause is an automatically generated route in the Docker provider integration that, by default, creates a backend pointing to the Traefik container itself [1][2]. This self-referencing route uses the container's hostname (e.g., traefik-service or the container name) [4].

Exploitation

Conditions An attacker who can reach the Traefik HTTP entrypoint on port 80 or 443 and knows the Docker container name or hostname can trigger the vulnerability. This can be as simple as a curl request with the --resolve flag to force the hostname resolution [4]. No authentication is required, and no complex setup is needed beyond the default Docker provider configuration [2].

Impact

When the self-referencing route is hit, it creates an endless loop of requests within the proxy, causing Traefik to consume 100% CPU and making the entire server unresponsive [4]. This results in a denial of service (DoS), rendering any services behind the reverse proxy unreachable until the container is manually restarted.

Mitigation

The vulnerability is fixed in Traefik versions 2.10.6 and 3.0.0-beta5 [1][3]. Users should upgrade to these patched versions. There are no known workarounds [1]. Upgrading directly addresses the automatic routing logic that created the self-loop.