UpHeron
All vulnerabilities

Servers and applications

CVE-2022-39271

HTTP/2 connections management could cause a deny of service

Severity
High 7.5
Published
10 Oct 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.8.8, 2.9.0-rc5
Also known as
GHSA-c6hx-pjc3-7fqr
Sources
NVD, Project advisories (GitHub)

Description

Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that assists in deploying microservices. There is a potential vulnerability in Traefik managing HTTP/2 connections. A closing HTTP/2 server connection could hang forever because of a subsequent fatal error. This failure mode could be exploited to cause a denial of service. There has been a patch released in versions…

Affected software

SoftwareAffected versions
TraefikServers and applications · cpe:a:traefik:traefik
  • Every version before 2.8.8
  • Version 2.9.0-rc1
  • Version 2.9.0-rc2
  • Version 2.9.0-rc3
  • Version 2.9.0-rc4
TraefikServers and applications · github:traefik/traefik
  • Every version up to 1.7.34
  • Every version before 2.8.8
  • From 2.9.0-rc1 before 2.9.0-rc5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-39271
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-39271
  • GitHub Advisory Database https://github.com/advisories/GHSA-c6hx-pjc3-7fqr
  • github.com https://github.com/traefik/traefik/security/advisories/GHSA-c6hx-pjc3-7fqr