{"id":"CVE-2026-119574","kind":"vulnerability","aliases":["CVE-2026-119574"],"related":[],"title":"Traefik: data race in experimental FastProxy lets anyone crash the proxy","description":"Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connections such as WebSocket, corrupting the unsynchronized shared bufio.Reader and triggering an unrecovered panic that terminates Traefik.","summary":"Traefik versions from 3.2.0 before 3.7.15 have a data race in the experimental FastProxy feature, where repeatedly opening and aborting HTTP/1 upgraded connections such as WebSocket corrupts a shared buffer. An unauthenticated attacker can trigger an unrecovered panic that terminates the Traefik process.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kubernetes","self-hosted","traefik","websocket"],"not_affected_if":["default-config","managed-hosting"],"how_to_check":"- Run `traefik version` and check whether it reports a version from `3.2.0` up to but not including `3.7.15`.\n- Check the static configuration for the experimental FastProxy setting; the sources do not name the exact key, so treat it as unknown.","fix":"- Move Traefik to `3.7.15` or later.","status":"open","published_at":"2026-10-30T14:16:46+00:00","first_seen_at":"2026-10-30T14:30:54+00:00","triaged_at":"2026-10-30T14:32:36+00:00","updated_at":"2026-10-30T14:32:36+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-30T14:32:36Z","model":"claude-haiku-5-5","output":{"fix":"- Move Traefik to `3.7.15` or later.","reach":"internet","title":"Traefik: data race in experimental FastProxy lets anyone crash the proxy","impact":"low","summary":"Traefik versions from 3.2.0 before 3.7.15 have a data race in the experimental FastProxy feature, where repeatedly opening and aborting HTTP/1 upgraded connections such as WebSocket corrupts a shared buffer. An unauthenticated attacker can trigger an unrecovered panic that terminates the Traefik process.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["traefik","self-hosted","kubernetes","websocket"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated attacker crashes the Traefik process repeatedly","analyst_note":"Confirm the FastProxy configuration key and whether it is enabled by default, using the NVD entry and the Traefik release notes for 3.7.15.","how_to_check":"- Run `traefik version` and check whether it reports a version from `3.2.0` up to but not including `3.7.15`.\n- Check the static configuration for the experimental FastProxy setting; the sources do not name the exact key, so treat it as unknown.","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting","default-config"],"who_is_affected":"Only Traefik deployments in the affected range that run the experimental FastProxy feature are exposed to the crash, since the flaw sits in that code path. The sources say an unauthenticated client can trigger it over HTTP/1 protocol upgrades such as WebSocket, so internet-facing Traefik instances are the main concern. Teams on managed hosting that do not run Traefik themselves can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000746,"input_tokens":4172,"output_tokens":658,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119574':14A,17A '-2026':13A,16A '3.2.0':28B,70C '3.7.15':30B,72C 'abort':44B,99C 'abus':90C 'allow':82C 'anyon':8A 'attack':57B,84C,94C 'buffer':54B 'bufio.reader':109C 'connect':47B,101C 'contain':73C 'corrupt':51B,105C 'crash':9A,86C 'cve':12A,15A 'data':2A,33B,75C 'experiment':5A,37B,79C 'fastproxi':6A,38B,80C 'featur':39B 'host':22B 'http/1':45B,91C 'infrastructur':18B 'kubernet':19B 'let':7A 'open':42B,97C 'panic':62B,114C 'process':67B,88C 'protocol':92C 'proxi':11A 'race':3A,34B,76C 'repeat':41B,96C 'self':21B 'self-host':20B 'share':53B,108C 'termin':64B,116C 'traefik':1A,23B,25B,66B,68C,117C 'trigger':59B,111C 'unauthent':56B,83C 'unrecov':61B,113C 'unsynchron':107C 'upgrad':46B,93C,100C 'version':26B 'websocket':24B,50B,104C","nicknames":[],"mitigations":[],"who_affected":"Only Traefik deployments in the affected range that run the experimental FastProxy feature are exposed to the crash, since the flaw sits in that code path. The sources say an unauthenticated client can trigger it over HTTP/1 protocol upgrades such as WebSocket, so internet-facing Traefik instances are the main concern. Teams on managed hosting that do not run Traefik themselves can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T14:16:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119574","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119574","severity":null,"published_at":"2026-10-30T14:16:46+00:00","modified_at":"2026-10-30T14:16:46+00:00","first_seen_at":"2026-10-30T14:30:54+00:00","fetched_at":"2026-10-30T14:30:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}