UpHeron
All vulnerabilities

Servers and applications

CVE-2023-29013

HTTP header parsing could cause a deny of service

Severity
High 7.5
Published
11 Apr 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.9.10, 2.10.0-rc2
Also known as
GHSA-7hj9-rv74-5g92
Sources
NVD, Project advisories (GitHub)

Description

Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices. There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik. HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This behavior could be exploited to cause a denial of service. This issue has been patched in versions…

Affected software

SoftwareAffected versions
TraefikServers and applications · cpe:a:traefik:traefik
  • Every version before 2.9.10
  • Version 2.10.0-rc1
TraefikServers and applications · github:traefik/traefik
  • Every version up to 1.7.34
  • Every version before 2.9.10
  • From 2.10.0-rc1 before 2.10.0-rc2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-29013
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-29013
  • GitHub Advisory Database https://github.com/advisories/GHSA-7hj9-rv74-5g92
  • github.com https://github.com/traefik/traefik/security/advisories/GHSA-7hj9-rv74-5g92