CVE-2023-29013: HTTP header parsing could cause a deny of service
Vulnerability summary
CVE-2023-29013 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in traefik. EPSS estimates a 1.08% chance of exploitation in the next 30 days, higher than 65.2% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 14-04-2023PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices. There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik. HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This behavior could be exploited to cause a denial of service. This issue has been patched in versions 2.9.10 and 2.10.0-rc2.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · GoEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.08%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.08% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Alpine1 product
- traefik< 2.9.10-r0
Github.com/traefik/traefik1 product
- v2< 2.9.10 | ≥ 2.10.0-rc1, < 2.10.0-rc2
Traefik1 product
- traefikEOL= 2.10.0-rc1 | < 2.9.10 | 2.10.0:rc1
3 vendors · 3 products
References
11 links- github.com/traefik/traefik/security/advisories/GHSA-7hj9-rv74-5g92X Refsource CONFIRMWEBVendor Advisory
- security.netapp.com/advisory/ntap-20230517-0008/Third Party Advisory
- github.com/traefik/traefikPACKAGE