CVE-2022-39271

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that assists in deploying microservices. There is a potential vulnerability in Traefik managing HTTP/2 connections. A closing HTTP/2 server connection could hang forever because of a subsequent fatal error. This failure mode could be exploited to cause a denial of service. There has been a patch released in versions 2.8.8 and 2.9.0-rc5. There are currently no known workarounds.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-755

Affected software

Vendor	Product	Versions
traefik	traefik	< 2.8.8; >= 2.9.0-rc1, < 2.9.0-rc5

References

https://github.com/traefik/traefik/releases/tag/v2.8.8Release Notes, Third Party Advisory
https://github.com/traefik/traefik/releases/tag/v2.9.0-rc5Release Notes, Third Party Advisory
https://github.com/traefik/traefik/security/advisories/GHSA-c6hx-pjc3-7fqrPatch, Third Party Advisory
https://github.com/traefik/traefik/releases/tag/v2.8.8Release Notes, Third Party Advisory
https://github.com/traefik/traefik/releases/tag/v2.9.0-rc5Release Notes, Third Party Advisory
https://github.com/traefik/traefik/security/advisories/GHSA-c6hx-pjc3-7fqrPatch, Third Party Advisory

Timeline

Published: Oct 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-392724.3Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Use CVE-2022-392737.5FlyteAdmin is the control plane for the data processing platform Flyte. Users who enable the default Flyte’s authorization server without ch CVE-2022-392749.8LoRaMac-node is a reference implementation and documentation of a LoRa network node. Versions of LoRaMac-node prior to 4.7.0 are vulnerable CVE-2022-392754.3Saleor is a headless, GraphQL commerce platform. In affected versions some GraphQL mutations were not properly checking the ID type input wh CVE-2022-392765.3GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service CVE-2022-392774.8GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service CVE-2022-392787.5Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to CVE-2022-392795.4discourse-chat is a plugin for the Discourse message board which adds chat functionality. In versions prior to 0.9 some places render a chat CVE-2022-39285.5Hardcoded credential is found in affected products' message queue. An attacker that manages to exploit this vulnerability will be able to ac CVE-2022-392807.5dparse is a parser for Python dependency files. dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular CVE-2022-392816.5fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions prior to 0.20.1 an authenticate CVE-2022-392827.5FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch m