UpHeron
All vulnerabilities

Servers and applications

CVE-2023-47124

Potential DDoS whith ACME HTTPChallenge

Severity
Medium 5.9
Published
4 Dec 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.10.6, 3.0.0-beta5
Also known as
GHSA-8g85-whqh-cr2f
Sources
NVD, Project advisories (GitHub)

Description

Traefik is an open source HTTP reverse proxy and load balancer. When Traefik is configured to use the `HTTPChallenge` to generate and renew the Let's Encrypt TLS certificates, the delay authorized to solve the challenge (50 seconds) can be exploited by attackers to achieve a `slowloris attack`. This vulnerability has been patch in version 2.10.6 and 3.0.0-beta5. Users are advised to upgrade.…

Affected software

SoftwareAffected versions
TraefikServers and applications · cpe:a:traefik:traefik
  • Every version up to 2.10.5
  • Version 3.0.0-beta1
  • Version 3.0.0-beta2
  • Version 3.0.0-beta3
  • Version 3.0.0-beta4
TraefikServers and applications · github:traefik/traefik
  • Every version up to 1.7.34
  • Every version before 2.10.6
  • Every version before 3.0.0-beta5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-47124
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-47124
  • GitHub Advisory Database https://github.com/advisories/GHSA-8g85-whqh-cr2f
  • github.com https://github.com/traefik/traefik/security/advisories/GHSA-8g85-whqh-cr2f