{"id":"GHSA-ww7c-q3mv-xx22","kind":"vulnerability","aliases":["GHSA-ww7c-q3mv-xx22"],"related":[],"title":"Data race on the shared bufio.Reader after an HTTP/1 upgrade in FastProxy panics the whole process","description":"## Summary\n\nThere is a high severity vulnerability in Traefik's experimental FastProxy (`experimental.fastProxy`). Once a backend answers a protocol upgrade (`101 Switching Protocols`, e.g. WebSocket), the connection pool keeps reading from the backend connection while the tunnel copier reads from the same buffered reader, with no synchronization between them. An unauthenticated client that repeatedly opens upgraded connections and aborts them can corrupt the reader's internal state and trigger an unrecovered panic that terminates the whole Traefik process, causing a denial of service.\n\nOnly deployments that enable `experimental.fastProxy` are affected. Traefik v2 is not affected, as FastProxy was introduced in v3.2. Traefik v3.2 to v3.6 are affected and no longer maintained, so they will not receive a patch: users on those versions should upgrade to a patched v3.7 release.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.7.15\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","summary":"When a backend accepts a protocol upgrade such as WebSocket, Traefik's experimental FastProxy reads the same buffered connection from two places with no locking. An unauthenticated client that repeatedly opens and aborts upgraded connections can corrupt that reader and crash the Traefik process, causing denial of service.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/traefik/traefik/v3","fixed":["v3.7.15"],"affected":">= v3.2.0, <= v3.7.14","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-567","kubernetes","runtime","self-hosted","traefik","websocket"],"not_affected_if":["default-config","traefik-v2"],"how_to_check":"- Check the Traefik version with `traefik version` and compare it against the affected range `>= v3.2.0, <= v3.7.14`.\n- Look in the static configuration for `experimental.fastProxy`; only deployments with it enabled are affected.","fix":"- Traefik `3.7.15` (the fixed version in the v3.7 line).\n- The advisory says v3.2 to v3.6 are no longer maintained and will not get a patch; move to a patched v3.7 release.","status":"open","published_at":"2026-10-16T08:00:59+00:00","first_seen_at":"2026-11-09T22:53:32+00:00","triaged_at":"2026-11-09T22:54:10+00:00","updated_at":"2026-11-09T22:54:10+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-09T22:54:10Z","model":"claude-haiku-5-5","output":{"fix":"- Traefik `3.7.15` (the fixed version in the v3.7 line).\n- The advisory says v3.2 to v3.6 are no longer maintained and will not get a patch; move to a patched v3.7 release.","reach":"internet","title":"Traefik: FastProxy data race lets a client crash the whole proxy","impact":"medium","summary":"When a backend accepts a protocol upgrade such as WebSocket, Traefik's experimental FastProxy reads the same buffered connection from two places with no locking. An unauthenticated client that repeatedly opens and aborts upgraded connections can corrupt that reader and crash the Traefik process, causing denial of service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["traefik","self-hosted","kubernetes","websocket"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated clients crash the entire Traefik process","analyst_note":"","how_to_check":"- Check the Traefik version with `traefik version` and compare it against the affected range `>= v3.2.0, <= v3.7.14`.\n- Look in the static configuration for `experimental.fastProxy`; only deployments with it enabled are affected.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","traefik-v2"],"who_is_affected":"Only deployments that enable the experimental FastProxy feature (`experimental.fastProxy`) are exposed; Traefik v2 is not affected because FastProxy arrived in v3.2. Teams running Traefik v3.2 through v3.7.14 with that flag set should look at their proxy in front of backends that use WebSocket or other protocol upgrades. Teams without the flag enabled can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000817,"input_tokens":4934,"output_tokens":647,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-567':31B '/traefik/traefik/issues).':239C '/traefik/traefik/releases/tag/v3.7.15':219C '/traefik/traefik/v3':29A '101':107C 'abort':71B,145C 'accept':42B 'advisori':232C 'affect':176C,181C,193C 'answer':103C 'backend':41B,102C,119C 'buffer':56B,129C 'bufio.reader':6A 'caus':83B,165C 'client':66B,138C 'comment':229C 'connect':57B,73B,113C,120C,143C 'copier':124C 'corrupt':75B,148C 'crash':79B 'cwe':30B 'data':1A 'denial':84B,167C 'deploy':171C 'e.g':110C 'enabl':173C 'experiment':51B,97C 'experimental.fastproxy':99C,174C 'fastproxi':12A,52B,98C,183C 'ghsa':18A,23A 'ghsa-ww7c-q3mv-xx22':17A,22A 'github.com':28A,218C,238C 'github.com/traefik/traefik/issues).':237C 'github.com/traefik/traefik/releases/tag/v3.7.15':217C 'github.com/traefik/traefik/v3':27A 'high':91C 'host':36B 'http/1':9A 'inform':222C 'intern':152C 'introduc':185C 'issu':236C 'keep':115C 'kubernet':32B 'lock':63B 'longer':196C 'maintain':197C 'open':69B,141C,234C 'panic':13A,158C 'patch':204C,213C,216C 'place':60B 'pleas':233C 'pool':114C 'process':16A,82B,164C 'protocol':44B,105C,109C 'q3mv':20A,25A 'question':227C 'race':2A 'read':53B,116C,125C 'reader':77B,130C,150C 'receiv':202C 'releas':215C 'repeat':68B,140C 'runtim':33B 'self':35B 'self-host':34B 'servic':86B,169C 'sever':92C 'share':5A 'state':153C 'summari':87C 'switch':108C 'synchron':133C 'termin':160C 'traefik':37B,49B,81B,95C,163C,177C,188C 'trigger':155C 'tunnel':123C 'two':59B 'unauthent':65B,137C 'unrecov':157C 'upgrad':10A,45B,72B,106C,142C,210C 'user':205C 'v2':178C 'v3.2':187C,189C 'v3.6':191C 'v3.7':214C 'version':208C 'vulner':93C 'websocket':38B,48B,111C 'whole':15A,162C 'ww7c':19A,24A 'xx22':21A,26A","nicknames":[],"mitigations":[],"who_affected":"Only deployments that enable the experimental FastProxy feature (`experimental.fastProxy`) are exposed; Traefik v2 is not affected because FastProxy arrived in v3.2. Teams running Traefik v3.2 through v3.7.14 with that flag set should look at their proxy in front of backends that use WebSocket or other protocol upgrades. Teams without the flag enabled can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomtraefiktraefikv3"],"ptokens":["com","github","traefik","v3"],"labels":["cwe567","go","high","kubernetes","runtime","selfhosted","traefik","websocket"],"campaign_type":null,"search_a":"'/traefik/traefik/v3':29A 'bufio.reader':6A 'data':1A 'fastproxi':12A 'ghsa':18A,23A 'ghsa-ww7c-q3mv-xx22':17A,22A 'github.com':28A 'github.com/traefik/traefik/v3':27A 'http/1':9A 'panic':13A 'process':16A 'q3mv':20A,25A 'race':2A 'share':5A 'upgrad':10A 'whole':15A 'ww7c':19A,24A 'xx22':21A,26A","search_b":"'-567':31B 'abort':71B 'accept':42B 'backend':41B 'buffer':56B 'caus':83B 'client':66B 'connect':57B,73B 'corrupt':75B 'crash':79B 'cwe':30B 'denial':84B 'experiment':51B 'fastproxi':52B 'host':36B 'kubernet':32B 'lock':63B 'open':69B 'place':60B 'process':82B 'protocol':44B 'read':53B 'reader':77B 'repeat':68B 'runtim':33B 'self':35B 'self-host':34B 'servic':86B 'traefik':37B,49B,81B 'two':59B 'unauthent':65B 'upgrad':45B,72B 'websocket':38B,48B","search_c":"'/traefik/traefik/issues).':239C '/traefik/traefik/releases/tag/v3.7.15':219C '101':107C 'abort':145C 'advisori':232C 'affect':176C,181C,193C 'answer':103C 'backend':102C,119C 'buffer':129C 'caus':165C 'client':138C 'comment':229C 'connect':113C,120C,143C 'copier':124C 'corrupt':148C 'denial':167C 'deploy':171C 'e.g':110C 'enabl':173C 'experiment':97C 'experimental.fastproxy':99C,174C 'fastproxi':98C,183C 'github.com':218C,238C 'github.com/traefik/traefik/issues).':237C 'github.com/traefik/traefik/releases/tag/v3.7.15':217C 'high':91C 'inform':222C 'intern':152C 'introduc':185C 'issu':236C 'keep':115C 'longer':196C 'maintain':197C 'open':141C,234C 'panic':158C 'patch':204C,213C,216C 'pleas':233C 'pool':114C 'process':164C 'protocol':105C,109C 'question':227C 'read':116C,125C 'reader':130C,150C 'receiv':202C 'releas':215C 'repeat':140C 'servic':169C 'sever':92C 'state':153C 'summari':87C 'switch':108C 'synchron':133C 'termin':160C 'traefik':95C,163C,177C,188C 'trigger':155C 'tunnel':123C 'unauthent':137C 'unrecov':157C 'upgrad':106C,142C,210C 'user':205C 'v2':178C 'v3.2':187C,189C 'v3.6':191C 'v3.7':214C 'version':208C 'vulner':93C 'websocket':111C 'whole':162C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-16T08:00:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-ww7c-q3mv-xx22","url":"https://github.com/traefik/traefik/security/advisories/GHSA-ww7c-q3mv-xx22","severity":"high","published_at":"2026-10-16T08:00:59+00:00","modified_at":"2026-10-16T08:00:59+00:00","first_seen_at":"2026-11-09T22:53:32+00:00","fetched_at":"2026-11-09T22:53:32+00:00","note":null}],"documents":[{"id":49643,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-ww7c-q3mv-xx22","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-16T08:00:59+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}