---
id: "GHSA-ww7c-q3mv-xx22"
page: "https://infrastack.ai/live/GHSA-ww7c-q3mv-xx22"
kind: "vulnerability"
aliases: ["GHSA-ww7c-q3mv-xx22"]
title: "Data race on the shared bufio.Reader after an HTTP/1 upgrade in FastProxy panics the whole process"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "github.com/traefik/traefik/v3", "fixed": ["v3.7.15"], "affected": ">= v3.2.0, <= v3.7.14", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cwe-567", "kubernetes", "runtime", "self-hosted", "traefik", "websocket"]
not_affected_if: ["default-config", "traefik-v2"]
published_at: "2026-10-16T08:00:59+00:00"
first_seen_at: "2026-11-09T22:53:32+00:00"
updated_at: "2026-11-09T22:54:10+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/traefik/traefik/security/advisories/GHSA-ww7c-q3mv-xx22", "first_seen_at": "2026-11-09T22:53:32+00:00"}]
exploit_sources: []
---

# Data race on the shared bufio.Reader after an HTTP/1 upgrade in FastProxy panics the whole process

Link for people: https://infrastack.ai/live/GHSA-ww7c-q3mv-xx22 (this .md is for agents)

When a backend accepts a protocol upgrade such as WebSocket, Traefik's experimental FastProxy reads the same buffered connection from two places with no locking. An unauthenticated client that repeatedly opens and aborts upgraded connections can corrupt that reader and crash the Traefik process, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/traefik/traefik/v3 affected >= v3.2.0, <= v3.7.14 fixed v3.7.15

## How to check

- Check the Traefik version with `traefik version` and compare it against the affected range `>= v3.2.0, <= v3.7.14`.
- Look in the static configuration for `experimental.fastProxy`; only deployments with it enabled are affected.

## Fix

- Traefik `3.7.15` (the fixed version in the v3.7 line).
- The advisory says v3.2 to v3.6 are no longer maintained and will not get a patch; move to a patched v3.7 release.

## Timeline

- 2026-11-09T22:53:32+00:00 ghsa-repo https://github.com/traefik/traefik/security/advisories/GHSA-ww7c-q3mv-xx22

## Documents

- [advisory] Vendor advisory: github.com https://github.com/traefik/traefik/security/advisories/GHSA-ww7c-q3mv-xx22

## From the sources

## Summary

There is a high severity vulnerability in Traefik's experimental FastProxy (`experimental.fastProxy`). Once a backend answers a protocol upgrade (`101 Switching Protocols`, e.g. WebSocket), the connection pool keeps reading from the backend connection while the tunnel copier reads from the same buffered reader, with no synchronization between them. An unauthenticated client that repeatedly opens upgraded connections and aborts them can corrupt the reader's internal state and trigger an unrecovered panic that terminates the whole Traefik process, causing a denial of service.

Only deployments that enable `experimental.fastProxy` are affected. Traefik v2 is not affected, as FastProxy was introduced in v3.2. Traefik v3.2 to v3.6 are affected and no longer maintained, so they will not receive a patch: users on those versions should upgrade to a patched v3.7 release.

## Patches

- https://github.com/traefik/traefik/releases/tag/v3.7.15

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_