GITHUB.COM/TRAEFIK/TRAEFIK/V3 · GHSA-x5pf-cqh3-2gv8 · Infrastructure
FIX → v3.8.0-rc.2 +1
Traefik's Compress middleware allocates about 18 MiB of zstd encoder state per response when zstd is enabled, which is the default. An unauthenticated client that opens many concurrent requests and reads slowly can make Traefik hold unbounded memory and crash.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Traefik v3 deployments from v3.1.0 through v3.7.17 (and the v3.8.0-rc.1 candidate) are exposed when the Compress middleware is enabled with zstd, which is the default encoding list. Traefik v2 is not affected because zstd support arrived in v3.1.0. Teams that do not use the Compress middleware, or that have restricted the encodings to exclude zstd, can skip it.
Not affected if compress-middleware-disabled, traefik-v2, zstd-not-enabled
Who cares go, kubernetes, self-hosted, traefik
traefik version and compare it against the affected ranges.zstd in its enabled encodings in the static or dynamic configuration.>= v3.1.0, <= v3.7.17 or the rc v3.8.0-rc.1.There is a potential vulnerability in Traefik's Compress middleware. When zstd is one of the enabled encodings (the default), the middleware creates its zstd encoder with the library default options, which hold about 18 MiB of memory for each response until the response is fully written. An unauthenticated client that opens many concurrent requests and reads the responses slowly can make Traefik hold an unbounded amount of memory and crash. The patched versions bound the encoder memory to less than 1 MiB per response, with no change to the compressed output.
Traefik v2 is not affected: zstd support in the Compress middleware was introduced in v3.1.0. The end-of-life v3 lines from v3.1 to v3.6 are affected and will not receive a patch. Upgrade to a patched version.
If you have any questions or comments about this advisory, please open an issue.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to v3.8.0-rc.2 +1
v3.7.18 for the v3.7 line.v3.8.0-rc.2 for the v3.8 release candidate line.