Live › vulnerability › CVE-2026-119574
Traefik versions from 3.2.0 before 3.7.15 have a data race in the experimental FastProxy feature, where repeatedly opening and aborting HTTP/1 upgraded connections such as WebSocket corrupts a shared buffer. An unauthenticated attacker can trigger an unrecovered panic that terminates the Traefik process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 14:30 UTC. All times on this page are UTC.
Only Traefik deployments in the affected range that run the experimental FastProxy feature are exposed to the crash, since the flaw sits in that code path. The sources say an unauthenticated client can trigger it over HTTP/1 protocol upgrades such as WebSocket, so internet-facing Traefik instances are the main concern. Teams on managed hosting that do not run Traefik themselves can skip it.
No product ranges from the sources yet.
traefik version and check whether it reports a version from 3.2.0 up to but not including 3.7.15.3.7.15 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connections such as WebSocket, corrupting the unsynchronized shared bufio.Reader and triggering an unrecovered panic that terminates Traefik.
This page as .md · .json · in your agent: get_signal("CVE-2026-119574")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.