PT-2026-133543

CVE-2026-119574

·

Published

2026-10-30

·

Updated

2026-10-30

Description by

CVSS 3.1
5.9
Medium
MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connections such as WebSocket, corrupting the unsynchronized shared bufio.Reader and triggering an unrecovered panic that terminates Traefik.
Exploitability
Fix
Vendors
Affected products
Weakness enumeration
CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context
Related identifiers
CVE-2026-119574
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com