UpHeron
All vulnerabilities

Servers and applications

GHSA-x5pf-cqh3-2gv8

Unauthenticated memory-exhaustion DoS: the Compress middleware pins ~18 MiB of zstd encoder state per in-flight response

Severity
High 8.7
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
3.7.18, 3.8.0-rc.2
Weakness
Allocation without limits (CWE-770)
Attack
Over the network · No login needed · No user action needed
Attacker can
Take it down
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Sources
Project advisories (GitHub)

Description

There is a potential vulnerability in Traefik's Compress middleware. When zstd is one of the enabled encodings (the default), the middleware creates its zstd encoder with the library default options, which hold about 18 MiB of memory for each response until the response is fully written. An unauthenticated client that opens many concurrent requests and reads the responses slowly can make Traefik hold an unbounded amount of memory and crash. The patched versions bound the encoder memory to less than 1 MiB per response, with no change to the compressed output.

Traefik v2 is not affected: zstd support in the Compress middleware was introduced in v3.1.0. The end-of-life v3 lines from v3.1 to v3.6 are affected and will not receive a patch. Upgrade to a patched version.

From traefik/traefik's security advisory.

Affected software

SoftwareAffected versions
TraefikServers and applications · github:traefik/traefik
  • From 3.1.0 before 3.7.18
  • From 3.8.0-rc.1 before 3.8.0-rc.2

References