CVE-2023-54365: Traefik HTTP/2 DoS Vulnerability

CVE-2023-54365 Overview

CVE-2023-54365 is a denial-of-service vulnerability in Traefik, a widely deployed cloud-native reverse proxy and load balancer. The flaw affects Traefik versions before 2.10.5 and 3.0.0-beta4. It is inherited from the Go standard library's HTTP/2 implementation and corresponds to the "Rapid Reset" attack class tracked as CVE-2023-44487 and CVE-2023-39325. Remote, unauthenticated attackers can rapidly open and cancel HTTP/2 streams to exhaust server resources. Successful exploitation renders Traefik instances unavailable, disrupting any downstream service routed through the proxy. The weakness is categorized under [CWE-400: Uncontrolled Resource Consumption].

Critical Impact
Unauthenticated remote attackers can exhaust Traefik server resources over HTTP/2, causing service-wide outages for all applications behind the proxy.

Affected Products

Traefik versions prior to 2.10.5
Traefik 3.0.0-beta releases prior to 3.0.0-beta4
Any deployment exposing HTTP/2 endpoints through vulnerable Traefik builds

Discovery Timeline

2026-06-23 - CVE-2023-54365 published to the National Vulnerability Database (NVD)
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2023-54365

Vulnerability Analysis

The vulnerability is a resource exhaustion flaw in HTTP/2 stream handling. Traefik proxies HTTP/2 traffic using the Go standard library's net/http and golang.org/x/net/http2 packages. Those libraries permit clients to open new streams and immediately cancel them with RST_STREAM frames at very high rates. Each opened stream still allocates server-side state and triggers request processing work, even when the client tears the stream down before completion. An attacker scripts this loop over a single HTTP/2 connection to inflict disproportionate CPU and memory cost on the proxy.

Root Cause

The root cause is the absence of effective rate limiting on stream creation and cancellation in the underlying HTTP/2 server implementation. Traefik inherits this behavior directly because it embeds the affected Go HTTP/2 stack. The protocol design allows a client to open up to the negotiated SETTINGS_MAX_CONCURRENT_STREAMS and immediately reset them, freeing the slot for another stream while the server is still cleaning up. This asymmetry between client cost and server cost is the foundation of the Rapid Reset technique.

Attack Vector

The attack is performed remotely over the network without authentication or user interaction. An attacker establishes a TLS-terminated HTTP/2 connection to a Traefik entrypoint and issues a continuous stream of HEADERS frames followed by RST_STREAM frames. With a small number of connections, a single attacker can saturate CPU on the proxy and degrade or halt request handling for all backend services. Refer to the GitHub Security Advisory and the VulnCheck Advisory on Traefik for protocol-level details.

Detection Methods for CVE-2023-54365

Indicators of Compromise

Sustained spikes in HTTP/2 RST_STREAM frames originating from a small number of source IPs
Sharp increases in Traefik CPU usage and goroutine counts without a matching rise in completed requests
High ratios of canceled or short-lived streams to fully processed requests in proxy access logs
Connection pools to upstream services becoming saturated while Traefik response latency climbs

Detection Strategies

Instrument Traefik with the Prometheus metrics endpoint and alert on anomalous rates of opened-versus-completed HTTP/2 streams
Correlate proxy CPU saturation with HTTP/2 connection counts at the load balancer or WAF tier
Inspect HTTP/2 frame telemetry at the TLS terminator for abnormal RST_STREAM frequency per connection

Monitoring Recommendations

Forward Traefik access logs and runtime metrics into a centralized analytics platform for baseline comparison
Alert on sudden goroutine growth or memory pressure on Traefik nodes
Track upstream backend error rates that correlate with proxy degradation to identify ongoing abuse

How to Mitigate CVE-2023-54365

Immediate Actions Required

Upgrade Traefik to version 2.10.5 or later on the 2.x branch
Upgrade pre-release deployments to 3.0.0-beta4 or later
Rebuild any custom Traefik binaries against a patched Go toolchain that addresses CVE-2023-39325
Restrict exposure of HTTP/2 entrypoints to trusted networks where operationally feasible

Patch Information

The Traefik maintainers released fixed builds in 2.10.5 and 3.0.0-beta4. These releases pull in the patched Go HTTP/2 server that limits the rate of new streams following resets. Operators running container images should pull updated tags and redeploy. Details are documented in the GitHub Security Advisory.

Workarounds

Place a Rapid Reset-aware WAF or CDN in front of Traefik to filter abusive HTTP/2 connections
Lower SETTINGS_MAX_CONCURRENT_STREAMS advertised by upstream terminators to constrain per-connection abuse
Disable HTTP/2 on exposed entrypoints as a temporary measure until patches are applied
Apply per-source-IP connection and request rate limits at the network edge

bash

# Verify the running Traefik version and pin a patched release
traefik version

# Example: pull a patched container image
docker pull traefik:2.10.5

# Optional: disable HTTP/2 on an entrypoint as a temporary workaround
# traefik.yml
# entryPoints:
#   websecure:
#     address: ":443"
#     http2:
#       maxConcurrentStreams: 100