Medium severity5.9NVD Advisory· Published Oct 30, 2026· Updated Oct 30, 2026

CVE-2026-119574

Description

Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connections such as WebSocket, corrupting the unsynchronized shared bufio.Reader and triggering an unrecovered panic that terminates Traefik.

Patches

Vulnerability mechanics

References

github.com/traefik/traefik/security/advisories/GHSA-ww7c-q3mv-xx22nvd
www.vulncheck.com/advisories/traefik-3.2.0-before-3.7.15-fastproxy-data-race-denial-of-servicenvd

News mentions

No linked articles in our index yet.