{"id":"EUVD-2023-60596","enisaUuid":"de584940-bd35-3657-9998-83e41b76dfc8","description":"Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library\u0027s HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the \u0027Rapid Reset\u0027 technique). A remote attacker can rapidly create and cancel HTTP/2 streams to exhaust server resources and cause service unavailability.","datePublished":"Jun 23, 2026, 12:12:51 PM","dateUpdated":"Jul 15, 2026, 1:27:56 AM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/traefik/traefik/security/advisories/GHSA-7v4p-328v-8v5g\nhttps://www.vulncheck.com/advisories/traefik-denial-of-service-via-http-2-request-handling\n","aliases":"CVE-2023-54365\nGHSA-pvrg-q6jw-42p7\n","assigner":"VulnCheck","epss":0.77,"enisaIdProduct":[{"id":"0bb14ba7-18bd-360d-b06c-bc25c14d5170","product":{"name":"traefik","vendor":{"name":"traefik"}},"product_version":"0 \u003c2.10.5"},{"id":"7ac3d496-558a-3835-8026-cf551e063769","product":{"name":"traefik","vendor":{"name":"traefik"}},"product_version":"3.0.0-beta1 \u003c3.0.0-beta4"}],"enisaIdVendor":[{"id":"890f2aac-c07c-3f0b-93ab-d7d441b4a657","vendor":{"name":"traefik"}}],"enisaIdVulnerability":[{"id":"db0c303e-04cf-374f-a0a8-35c15f7ebfed","vulnerability":{"id":"CVE-2023-54365","description":"Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library\u0027s HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the \u0027Rapid Reset\u0027 technique). A remote attacker can rapidly create and cancel HTTP/2 streams to exhaust server resources and cause service unavailability.","datePublished":"Jun 23, 2026, 12:12:51 PM","dateUpdated":"Jul 15, 2026, 1:27:56 AM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/traefik/traefik/security/advisories/GHSA-7v4p-328v-8v5g\nhttps://www.vulncheck.com/advisories/traefik-denial-of-service-via-http-2-request-handling\n","enisa_id":"EUVD-2023-60596\n","assigner":"VulnCheck","epss":0.77,"dataProcessed":"Oct 31, 2026, 7:15:10 AM","vulnerabilityProduct":[{"id":"849bd676-dfec-35f9-b257-b4bbb07e80a0","product":{"name":"traefik","vendor":{"name":"traefik"}},"product_version":"0 \u003c2.10.5"},{"id":"a0d46689-e19f-317b-9da9-9f2f0101ea0d","product":{"name":"traefik","vendor":{"name":"traefik"}},"product_version":"3.0.0-beta1 \u003c3.0.0-beta4"}],"vulnerabilityVendor":[{"id":"0d628411-a4f4-38ef-bc9a-f3260b2a8b11","vendor":{"name":"traefik"}}]}},{"id":"f86fa6f3-cc74-39b0-b8f2-a68fbeed5008","vulnerability":{"id":"GHSA-pvrg-q6jw-42p7","description":"Duplicate Advisory: Traefik vulnerable to HTTP/2 request causing denial of service ","datePublished":"Jun 23, 2026, 3:32:36 PM","dateUpdated":"Sep 22, 2026, 7:37:41 PM","baseScore":0.0,"references":"https://github.com/traefik/traefik/security/advisories/GHSA-7v4p-328v-8v5g\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-54365\nhttps://access.redhat.com/security/cve/CVE-2023-54365\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d2491710\nhttps://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54365.json\nhttps://www.vulncheck.com/advisories/traefik-denial-of-service-via-http-2-request-handling\n","enisa_id":"EUVD-2023-60596\n","aliases":"GHSA-pvrg-q6jw-42p7\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}