CVE-2023-54365: Traefik HTTP/2 Denial of Service Vulnerability – Rapid Reset Attack

Technical summary

CVE-2023-54365 is a resource-exhaustion vulnerability in Traefik's HTTP/2 stream handling, rooted in the Go standard library's implementation of the HTTP/2 specification. The vulnerability permits a remote, unauthenticated actor to execute a 'Rapid Reset' attack (also documented in CVE-2023-44487 and CVE-2023-39325), wherein streams are created and immediately reset in rapid succession. This forces the server to allocate and then deallocate resources repeatedly, consuming CPU, memory, and connection limits. The attack vector is network-based, requires no privileges, and can be launched from any Internet-connected client. The impact is denial of service—legitimate traffic may be delayed or dropped as the proxy becomes unresponsive.

Business impact

Traefik is often deployed as the central ingress or API gateway in containerized and cloud-native environments, making it a critical chokepoint for application traffic. A successful DoS attack renders dependent applications unreachable, causing immediate service disruption. Organizations relying on Traefik without upstream rate-limiting or DDoS mitigation are at heightened risk. The attack requires no exploitation of application logic; it operates at the transport layer, bypassing many application-level defenses. Affected deployments may experience customer-facing downtime, SLA violations, and reputational damage.

Affected systems

Traefik versions before 2.10.5 (stable branch) and 3.0.0-beta4 (beta branch) are affected. The vulnerability also impacts any downstream software that bundles Go's net/http library with vulnerable HTTP/2 code, including Red Hat OpenShift AI. Organizations using older Traefik releases in production, particularly in containerized orchestration platforms (Kubernetes, Docker Swarm), should inventory their deployments immediately. The Go standard library versions corresponding to the Rapid Reset CVEs (CVE-2023-44487, CVE-2023-39325) provide additional context for Go-based services.

Exploitability

The attack is highly exploitable. No authentication, advanced credentials, or user interaction is required. An attacker merely needs network reachability to the Traefik instance and can execute the attack using standard HTTP/2 client libraries or tools. The technique is well-documented in public disclosures of the underlying Rapid Reset flaws. Proof-of-concept code has been published, lowering the barrier to weaponization. Organizations without network segmentation or rate-limiting safeguards in front of Traefik should consider this vulnerability practically ready for active exploitation.

Remediation

Upgrade Traefik to version 2.10.5 or later for the stable 2.x branch, or 3.0.0-beta4 or later for the 3.x beta. Patch releases are the definitive remediation. Until patches are deployed, apply interim controls: place Traefik behind a load balancer or reverse proxy with HTTP/2 stream reset rate-limiting enabled, configure firewall rules to restrict HTTP/2 access to trusted sources, and enable resource quotas on container/pod memory and CPU. Monitor for unusual patterns of stream resets or HTTP/2 errors in Traefik logs.

Patch guidance

Check the Traefik release notes and GitHub repository for availability of patched versions. Stable users should upgrade to 2.10.5 or later; beta users to 3.0.0-beta4 or later. Verify that your Traefik distribution (whether from the official Traefik Labs repository, a Linux distribution, or a cloud provider) has been updated. Test patched versions in a non-production environment first to confirm compatibility with your routing rules and middleware configuration. If you are using Traefik bundled within another product (e.g., OpenShift), check the vendor advisory for coordinated patching timelines.

Detection guidance

Monitor Traefik logs for elevated HTTP/2 stream reset events or rapid succession of stream closures without data transfer. Watch for spikes in CPU or memory consumption correlating with inbound HTTP/2 traffic. Network-based detection can identify rapid TCP/TLS connections followed by quick resets from a single source or small set of sources to your Traefik endpoints. Consider deploying upstream HTTP/2-aware WAF or DDoS mitigation rules that throttle or block clients exceeding normal stream reset rates. Internal clients creating legitimate mass streams (e.g., bulk API clients) should be baselined to distinguish from attack traffic.

Why prioritize this

This vulnerability combines high exploitability (no authentication, simple attack mechanism) with significant business impact (denial of service to a critical infrastructure component). Traefik's role as an ingress point in modern deployments means compromise directly affects service availability. The CVSS 7.5 (HIGH) score reflects the severity. Organizations should treat this as a near-term priority, particularly if Traefik is internet-facing or serves customer-critical workloads. The availability of patches and the straightforward upgrade path make remediation achievable quickly.

Risk score, explained

The CVSS v3.1 score of 7.5 reflects a network-accessible, unauthenticated attack that has high availability impact (denial of service). There is no confidentiality or integrity impact. The score is elevated because the attack is trivial to execute and affects a widely-deployed component. However, it does not reach critical (9.0+) because successful exploitation does not grant persistent access, code execution, or data exfiltration. Environments with strong network segmentation or upstream rate-limiting may realize lower practical risk, but unsegmented or internet-facing deployments face the full HIGH severity.

Frequently asked questions