{"id":"GHSA-x5pf-cqh3-2gv8","kind":"vulnerability","aliases":["GHSA-x5pf-cqh3-2gv8"],"related":[],"title":"Unauthenticated memory-exhaustion DoS: the Compress middleware pins ~18 MiB of zstd encoder state per in-flight response","description":"## Summary\n\nThere is a potential vulnerability in Traefik's Compress middleware. When `zstd` is one of the enabled encodings (the default), the middleware creates its zstd encoder with the library default options, which hold about 18 MiB of memory for each response until the response is fully written. An unauthenticated client that opens many concurrent requests and reads the responses slowly can make Traefik hold an unbounded amount of memory and crash. The patched versions bound the encoder memory to less than 1 MiB per response, with no change to the compressed output.\n\nTraefik v2 is not affected: zstd support in the Compress middleware was introduced in v3.1.0. The end-of-life v3 lines from v3.1 to v3.6 are affected and will not receive a patch. Upgrade to a patched version.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.7.18\n- https://github.com/traefik/traefik/releases/tag/v3.8.0-rc.2\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","summary":"Traefik's Compress middleware allocates about 18 MiB of zstd encoder state per response when zstd is enabled, which is the default. An unauthenticated client that opens many concurrent requests and reads slowly can make Traefik hold unbounded memory and crash.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/traefik/traefik/v3","fixed":["v3.7.18"],"affected":">= v3.1.0, <= v3.7.17","ecosystem":"go"},{"name":"github.com/traefik/traefik/v3","fixed":["v3.8.0-rc.2"],"affected":">= v3.8.0-rc.1, <= v3.8.0-rc.1","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-770","go","infrastructure","kubernetes","self-hosted","traefik"],"not_affected_if":["compress-middleware-disabled","traefik-v2","zstd-not-enabled"],"how_to_check":"- Check the Traefik version with `traefik version` and compare it against the affected ranges.\n- Look for a Compress middleware with `zstd` in its enabled encodings in the static or dynamic configuration.\n- Confirm the version is in the affected range `>= v3.1.0, <= v3.7.17` or the rc `v3.8.0-rc.1`.","fix":"- Traefik `v3.7.18` for the v3.7 line.\n- Traefik `v3.8.0-rc.2` for the v3.8 release candidate line.\n- The advisory states that v3.1 to v3.6 are end-of-life and will not receive a patch; upgrade to a patched version.","status":"open","published_at":"2026-11-12T10:01:26+00:00","first_seen_at":"2026-11-12T10:09:07+00:00","triaged_at":"2026-11-12T10:10:17+00:00","updated_at":"2026-11-12T10:10:17+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-12T10:10:17Z","model":"claude-haiku-5-5","output":{"fix":"- Traefik `v3.7.18` for the v3.7 line.\n- Traefik `v3.8.0-rc.2` for the v3.8 release candidate line.\n- The advisory states that v3.1 to v3.6 are end-of-life and will not receive a patch; upgrade to a patched version.","reach":"internet","title":"Traefik: Compress middleware lets unauthenticated clients exhaust server memory","impact":"medium","summary":"Traefik's Compress middleware allocates about 18 MiB of zstd encoder state per response when zstd is enabled, which is the default. An unauthenticated client that opens many concurrent requests and reads slowly can make Traefik hold unbounded memory and crash.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["traefik","self-hosted","kubernetes","go"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated clients crash Traefik by exhausting its memory","analyst_note":"","how_to_check":"- Check the Traefik version with `traefik version` and compare it against the affected ranges.\n- Look for a Compress middleware with `zstd` in its enabled encodings in the static or dynamic configuration.\n- Confirm the version is in the affected range `>= v3.1.0, <= v3.7.17` or the rc `v3.8.0-rc.1`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["traefik-v2","compress-middleware-disabled","zstd-not-enabled"],"who_is_affected":"Traefik v3 deployments from v3.1.0 through v3.7.17 (and the v3.8.0-rc.1 candidate) are exposed when the Compress middleware is enabled with zstd, which is the default encoding list. Traefik v2 is not affected because zstd support arrived in v3.1.0. Teams that do not use the Compress middleware, or that have restricted the encodings to exclude zstd, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00087,"input_tokens":4996,"output_tokens":740,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-770':38B '/traefik/traefik/issues).':245C '/traefik/traefik/releases/tag/v3.7.18':222C '/traefik/traefik/releases/tag/v3.8.0-rc.2':225C '/traefik/traefik/v3':33A,36A '1':169C '18':10A,52B,122C '2gv8':25A,30A 'advisori':238C 'affect':184C,207C 'alloc':50B 'amount':154C 'bound':162C 'chang':175C 'client':70B,137C 'comment':235C 'compress':7A,48B,96C,178C,189C 'concurr':74B,141C 'cqh3':24A,29A 'crash':86B,158C 'creat':110C 'cwe':37B 'default':67B,107C,117C 'dos':5A 'enabl':63B,104C 'encod':14A,56B,105C,113C,164C 'end':197C 'end-of-lif':196C 'exhaust':4A 'flight':19A 'fulli':133C 'ghsa':22A,27A 'ghsa-x5pf-cqh3-2gv8':21A,26A 'github.com':32A,35A,221C,224C,244C 'github.com/traefik/traefik/issues).':243C 'github.com/traefik/traefik/releases/tag/v3.7.18':220C 'github.com/traefik/traefik/releases/tag/v3.8.0-rc.2':223C 'github.com/traefik/traefik/v3':31A,34A 'go':39B 'hold':82B,120C,151C 'host':44B 'in-flight':17A 'inform':228C 'infrastructur':40B 'introduc':192C 'issu':242C 'kubernet':41B 'less':167C 'librari':116C 'life':199C 'line':201C 'make':80B,149C 'mani':73B,140C 'memori':3A,84B,125C,156C,165C 'memory-exhaust':2A 'mib':11A,53B,123C,170C 'middlewar':8A,49B,97C,109C,190C 'one':101C 'open':72B,139C,240C 'option':118C 'output':179C 'patch':160C,213C,217C,219C 'per':16A,58B,171C 'pin':9A 'pleas':239C 'potenti':91C 'question':233C 'read':77B,144C 'receiv':211C 'request':75B,142C 'respons':20A,59B,128C,131C,146C,172C 'self':43B 'self-host':42B 'slowli':78B,147C 'state':15A,57B 'summari':87C 'support':186C 'traefik':45B,46B,81B,94C,150C,180C 'unauthent':1A,69B,136C 'unbound':83B,153C 'upgrad':214C 'v2':181C 'v3':200C 'v3.1':203C 'v3.1.0':194C 'v3.6':205C 'version':161C,218C 'vulner':92C 'written':134C 'x5pf':23A,28A 'zstd':13A,55B,61B,99C,112C,185C","nicknames":[],"mitigations":[],"who_affected":"Traefik v3 deployments from v3.1.0 through v3.7.17 (and the v3.8.0-rc.1 candidate) are exposed when the Compress middleware is enabled with zstd, which is the default encoding list. Traefik v2 is not affected because zstd support arrived in v3.1.0. Teams that do not use the Compress middleware, or that have restricted the encodings to exclude zstd, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomtraefiktraefikv3"],"ptokens":["com","github","traefik","v3"],"labels":["cwe770","go","high","infrastructure","kubernetes","selfhosted","traefik"],"campaign_type":null,"search_a":"'/traefik/traefik/v3':33A,36A '18':10A '2gv8':25A,30A 'compress':7A 'cqh3':24A,29A 'dos':5A 'encod':14A 'exhaust':4A 'flight':19A 'ghsa':22A,27A 'ghsa-x5pf-cqh3-2gv8':21A,26A 'github.com':32A,35A 'github.com/traefik/traefik/v3':31A,34A 'in-flight':17A 'memori':3A 'memory-exhaust':2A 'mib':11A 'middlewar':8A 'per':16A 'pin':9A 'respons':20A 'state':15A 'unauthent':1A 'x5pf':23A,28A 'zstd':13A","search_b":"'-770':38B '18':52B 'alloc':50B 'client':70B 'compress':48B 'concurr':74B 'crash':86B 'cwe':37B 'default':67B 'enabl':63B 'encod':56B 'go':39B 'hold':82B 'host':44B 'infrastructur':40B 'kubernet':41B 'make':80B 'mani':73B 'memori':84B 'mib':53B 'middlewar':49B 'open':72B 'per':58B 'read':77B 'request':75B 'respons':59B 'self':43B 'self-host':42B 'slowli':78B 'state':57B 'traefik':45B,46B,81B 'unauthent':69B 'unbound':83B 'zstd':55B,61B","search_c":"'/traefik/traefik/issues).':245C '/traefik/traefik/releases/tag/v3.7.18':222C '/traefik/traefik/releases/tag/v3.8.0-rc.2':225C '1':169C '18':122C 'advisori':238C 'affect':184C,207C 'amount':154C 'bound':162C 'chang':175C 'client':137C 'comment':235C 'compress':96C,178C,189C 'concurr':141C 'crash':158C 'creat':110C 'default':107C,117C 'enabl':104C 'encod':105C,113C,164C 'end':197C 'end-of-lif':196C 'fulli':133C 'github.com':221C,224C,244C 'github.com/traefik/traefik/issues).':243C 'github.com/traefik/traefik/releases/tag/v3.7.18':220C 'github.com/traefik/traefik/releases/tag/v3.8.0-rc.2':223C 'hold':120C,151C 'inform':228C 'introduc':192C 'issu':242C 'less':167C 'librari':116C 'life':199C 'line':201C 'make':149C 'mani':140C 'memori':125C,156C,165C 'mib':123C,170C 'middlewar':97C,109C,190C 'one':101C 'open':139C,240C 'option':118C 'output':179C 'patch':160C,213C,217C,219C 'per':171C 'pleas':239C 'potenti':91C 'question':233C 'read':144C 'receiv':211C 'request':142C 'respons':128C,131C,146C,172C 'slowli':147C 'summari':87C 'support':186C 'traefik':94C,150C,180C 'unauthent':136C 'unbound':153C 'upgrad':214C 'v2':181C 'v3':200C 'v3.1':203C 'v3.1.0':194C 'v3.6':205C 'version':161C,218C 'vulner':92C 'written':134C 'zstd':99C,112C,185C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T10:01:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-x5pf-cqh3-2gv8","url":"https://github.com/traefik/traefik/security/advisories/GHSA-x5pf-cqh3-2gv8","severity":"high","published_at":"2026-11-12T10:01:26+00:00","modified_at":"2026-11-12T10:01:26+00:00","first_seen_at":"2026-11-12T10:09:07+00:00","fetched_at":"2026-11-12T10:09:07+00:00","note":null}],"documents":[{"id":133897,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-x5pf-cqh3-2gv8","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}