CVE-2022-39271

HIGH

Traefik < 2.8.8 - Improper Exception Handling

Title source: rule

Description

Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that assists in deploying microservices. There is a potential vulnerability in Traefik managing HTTP/2 connections. A closing HTTP/2 server connection could hang forever because of a subsequent fatal error. This failure mode could be exploited to cause a denial of service. There has been a patch released in versions 2.8.8 and 2.9.0-rc5. There are currently no known workarounds.

Scores

CVSS v3 7.5
EPSS 0.0048
EPSS Percentile 64.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Classification

CWE
CWE-755 CWE-400
Status published

Affected Products (6)

traefik/traefik < 2.8.8
traefik/traefik
traefik/traefik
traefik/traefik
traefik/traefik
traefik/traefik < 2.8.8Go

Timeline

Published Oct 11, 2022
Tracked Since Feb 18, 2026