Read the docs
TI-2024-38732 Aliases GHSA-f7cq-5v43-8pwp

Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop

Priority LOW 38CWE-1395Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

### Impact There is a vulnerability in [GO managing malformed DNS message](https://groups.google.com/g/golang-announce/c/wkkO4P9stm0), which impacts Traefik. This vulnerability could be exploited to cause a denial of service. ### References - [CVE-2024-24788](https://www.cve.org/CVERecord?id=CVE-2024-24788) ### Patches - https://github.com/traefik/traefik/releases/tag/v2.11.3 - https://github.com/traefik/traefik/releases/tag/v3.0.1 ### Workarounds No workaround. ### For more information If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

Why it matters now

Fix Fixed github.com/traefik/traefik/v2 (Go): 2.11.3github.com/traefik/traefik/v3 (Go): 3.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—github.com/traefik/traefik/v2 (Go)before 2.11.32.11.3Patch availableGHSA-f7cq-5v43-8pwp
—github.com/traefik/traefik/v3 (Go)before 3.0.13.0.1Patch availableGHSA-f7cq-5v43-8pwp
—github.com/traefik/traefik (Go)up to 1.7.34—No fix listedGHSA-f7cq-5v43-8pwp
  • github.com/traefik/traefik/v2 (Go) Vendor— Affected before 2.11.3 Fixed in 2.11.3 Patch available GHSA-f7cq-5v43-8pwp
  • github.com/traefik/traefik/v3 (Go) Vendor— Affected before 3.0.1 Fixed in 3.0.1 Patch available GHSA-f7cq-5v43-8pwp
  • github.com/traefik/traefik (Go) Vendor— Affected up to 1.7.34 Fixed in — No fix listed GHSA-f7cq-5v43-8pwp

Remediation

  • Fix · GHSA-f7cq-5v43-8pwp github.com/traefik/traefik/v2 (Go) Fixed in 2.11.3 Advisory →
  • Fix · GHSA-f7cq-5v43-8pwp github.com/traefik/traefik/v3 (Go) Fixed in 3.0.1 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-f7cq-5v43-8pwp

References

Advisory 1

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences