← Vulnerability feed

Vulnerability record · CVE-2023-54365 · published 23 June 2026

CVE-2023-54365: Traefik uncontrolled resource consumption vulnerability

Traefik · Traefik

Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' technique). A remote attacker can rapidly create and cancel HTTP/2 streams to exhaust server resources and cause service unavailability.

8.7 CVSS 4.0 High EPSS 0.77% · top 46.1% CWE-400 · Uncontrolled resource consumptionCWE-770 · Allocation without limits
8.7CVSS 4.0 base score
0.77%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
5References
26 Sep 2026Last modified by NVD

Description

Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' technique). A remote attacker can rapidly create and cancel HTTP/2 streams to exhaust server resources and cause service unavailability.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/traefik/traefik/security/advisories/GHSA-7v4p-328v-8v5g PatchVendor Advisory
https://www.vulncheck.com/advisories/traefik-denial-of-service-via-http-2-request-handling Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-54365 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2491710 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54365.json Third Party Advisory

Track CVE-2023-54365 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-42271LiteLLM MCP test endpoints allow authenticated OS command injectionLiteLLM versions 1.74.2 through before 1.83.7 expose two MCP preview endpoints (POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list) th…KEVEPSS 13%analysed8.1CVE-2020-0601Windows CryptoAPI ECC certificate validation spoofing flawWindows CryptoAPI (Crypt32.dll) improperly validates Elliptic Curve Cryptography certificates, allowing a spoofed code-signing certificate to be trus…KEVEPSS 89%analysed7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed6.5CVE-2026-48710Starlette Host header validation flaw enables request.url path mismatchStarlette before 1.0.1 did not validate the HTTP Host header before using it to rebuild request.url, so a malformed Host value could make request.url…KEVEPSS 7.1%analysed10.0CVE-2025-68121Golang go improper certificate validation vulnerabilityDuring session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the r…EPSS 0.86%9.9CVE-2026-5483Redhat openshift ai vulnerabilityA flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows…EPSS 0.65%9.8CVE-2026-27143Golang go vulnerabilityArithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid …EPSS 0.66%9.8CVE-2024-24790Golang go vulnerabilityThe various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which woul…EPSS 2.0%

Source: NIST National Vulnerability Database (record CVE-2023-54365), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.