---
id: "GHSA-x5pf-cqh3-2gv8"
page: "https://infrastack.ai/live/GHSA-x5pf-cqh3-2gv8"
kind: "vulnerability"
aliases: ["GHSA-x5pf-cqh3-2gv8"]
title: "Unauthenticated memory-exhaustion DoS: the Compress middleware pins ~18 MiB of zstd encoder state per in-flight response"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "github.com/traefik/traefik/v3", "fixed": ["v3.7.18"], "affected": ">= v3.1.0, <= v3.7.17", "ecosystem": "go"}, {"name": "github.com/traefik/traefik/v3", "fixed": ["v3.8.0-rc.2"], "affected": ">= v3.8.0-rc.1, <= v3.8.0-rc.1", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cwe-770", "go", "infrastructure", "kubernetes", "self-hosted", "traefik"]
not_affected_if: ["compress-middleware-disabled", "traefik-v2", "zstd-not-enabled"]
published_at: "2026-11-12T10:01:26+00:00"
first_seen_at: "2026-11-12T10:09:07+00:00"
updated_at: "2026-11-12T10:10:17+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/traefik/traefik/security/advisories/GHSA-x5pf-cqh3-2gv8", "first_seen_at": "2026-11-12T10:09:07+00:00"}]
exploit_sources: []
---

# Unauthenticated memory-exhaustion DoS: the Compress middleware pins ~18 MiB of zstd encoder state per in-flight response

Link for people: https://infrastack.ai/live/GHSA-x5pf-cqh3-2gv8 (this .md is for agents)

Traefik's Compress middleware allocates about 18 MiB of zstd encoder state per response when zstd is enabled, which is the default. An unauthenticated client that opens many concurrent requests and reads slowly can make Traefik hold unbounded memory and crash.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/traefik/traefik/v3 affected >= v3.1.0, <= v3.7.17 fixed v3.7.18
- go:github.com/traefik/traefik/v3 affected >= v3.8.0-rc.1, <= v3.8.0-rc.1 fixed v3.8.0-rc.2

## How to check

- Check the Traefik version with `traefik version` and compare it against the affected ranges.
- Look for a Compress middleware with `zstd` in its enabled encodings in the static or dynamic configuration.
- Confirm the version is in the affected range `>= v3.1.0, <= v3.7.17` or the rc `v3.8.0-rc.1`.

## Fix

- Traefik `v3.7.18` for the v3.7 line.
- Traefik `v3.8.0-rc.2` for the v3.8 release candidate line.
- The advisory states that v3.1 to v3.6 are end-of-life and will not receive a patch; upgrade to a patched version.

## Timeline

- 2026-11-12T10:09:07+00:00 ghsa-repo https://github.com/traefik/traefik/security/advisories/GHSA-x5pf-cqh3-2gv8

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/traefik/traefik/security/advisories/GHSA-x5pf-cqh3-2gv8

## From the sources

## Summary

There is a potential vulnerability in Traefik's Compress middleware. When `zstd` is one of the enabled encodings (the default), the middleware creates its zstd encoder with the library default options, which hold about 18 MiB of memory for each response until the response is fully written. An unauthenticated client that opens many concurrent requests and reads the responses slowly can make Traefik hold an unbounded amount of memory and crash. The patched versions bound the encoder memory to less than 1 MiB per response, with no change to the compressed output.

Traefik v2 is not affected: zstd support in the Compress middleware was introduced in v3.1.0. The end-of-life v3 lines from v3.1 to v3.6 are affected and will not receive a patch. Upgrade to a patched version.

## Patches

- https://github.com/traefik/traefik/releases/tag/v3.7.18
- https://github.com/traefik/traefik/releases/tag/v3.8.0-rc.2

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_