CVE-2026-119574: Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service

Published Oct 30, 2026

Updated

Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connections such as WebSocket, corrupting the unsynchronized shared bufio.Reader and triggering an unrecovered panic that terminates Traefik.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Traefik to a version that resolves this vulnerability.
Fixed in 3.7.15

Event History

Oct 30, 2026

CVE Published

via MITRE·01:18 PM

Data Sourced

via MITRE·01:18 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Traefik deployments running versions from 3.2.0 up to, but not including, 3.7.15 are affected if they use the experimental FastProxy. An attacker can reach the vulnerable behavior over the network without authentication.

What does an attacker need to do to trigger the denial of service?

The attacker needs to abuse HTTP/1 protocol upgrades by repeatedly opening and aborting upgraded connections, such as WebSocket connections. This can corrupt a shared bufio.Reader and cause an unrecovered panic that terminates the Traefik process.

Is FastProxy required for exploitation?

Yes. The vulnerable data race is in the experimental FastProxy, so the described attack applies to deployments using that component.

What is the remediation version?

Upgrade Traefik to version 3.7.15 or later. The affected range is 3.2.0 before 3.7.15.

CVE-2026-119574: Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the denial of service?

Is FastProxy required for exploitation?

What is the remediation version?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the denial of service?

Is FastProxy required for exploitation?

What is the remediation version?