[github.com/traefik/traefik/v2] Traefik HTTP/2 connections management could cause a denial of service

Impact

There is a potential vulnerability in Traefik managing HTTP/2 connections.
A closing HTTP/2 server connection could hang forever because of a subsequent fatal error. This failure mode could be exploited to cause a denial of service.

Patches

Traefik v2.8.x: https://github.com/traefik/traefik/releases/tag/v2.8.8
Traefik v2.9.x: https://github.com/traefik/traefik/releases/tag/v2.9.0-rc5

Workarounds

No workaround.

For more information

If you have any questions or comments about this advisory, please open an issue.

References

• https://github.com/traefik/traefik/security/advisories/GHSA-c6hx-pjc3-7fqr
• https://github.com/traefik/traefik/releases/tag/v2.8.8
• https://github.com/traefik/traefik/releases/tag/v2.9.0-rc5
• https://nvd.nist.gov/vuln/detail/CVE-2022-39271
• https://github.com/advisories/GHSA-c6hx-pjc3-7fqr