High severity · published Apr 14, 2023
CVE-2023-29013
Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices
7.5
CVSS
1.1%
EPSS
No
On KEV
Description
Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices. There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik. HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This behavior could be exploited to cause a denial of service. This issue has been patched in versions 2.9.10 and 2.10.0-rc2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
Traefik · Traefik
before 2.9.10; 2.10.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-29013
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-29013
Patch
https://github.com/traefik/traefik/commit/4ed3964b3586565519249bbdc55eb1b961c08c49
Release Notes
https://github.com/traefik/traefik/releases/tag/v2.10.0-rc2
Release Notes
https://github.com/traefik/traefik/releases/tag/v2.9.10
Vendor Advisory
https://github.com/traefik/traefik/security/advisories/GHSA-7hj9-rv74-5g92
Third Party Advisory
https://security.netapp.com/advisory/ntap-20230517-0008/
More from Traefik
10.0
CVE-2026-54763
Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
10.0
CVE-2026-53622
Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
10.0
CVE-2026-48491
Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass
10.0
CVE-2026-48020
Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
10.0
CVE-2026-39858
Traefik: Forwarded alias spoofing top pre-auth decision bypass
