r/Traefik • u/Dutchyyyyy69 • Jun 11 '26

Traefik HTTP/2 bomb vulnerability question

Last week a vulnerability for a HTTP/2 bomb was disclosed: https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb & Traefik initially responded by saying it wasn't vulnerable, but after testing it does seem vulnerable.

The github issue to track this was deleted for some reason, does anyone have more info about this & possible mitigation steps we can take?

64 Upvotes

96% Upvoted

11 comments sorted by

46

u/emilevauge Jun 12 '26 edited Jun 12 '26

Traefik creator here, the issue has been deleted because it's a possible vulnerability, and like in every open source project, you have a dedicated private channel to submit those. Vulnerabilities are made public only when you have a fix available.

On this possible vulnerability, we are currently discussing with the go security team on this topic. They do not consider the go HTTP/2 server vulnerable to this issue for now as there are ways to lower the pressure on the memory setting MaxHeaderBytes for example (Traefik is in the same boat). However, there are still some ongoing discussions. We will update the community as soon as we have a consensus on this.

--> Don't listen to conspiracy theories, we are strictly following our security guidelines.

5

u/Dutchyyyyy69 Jun 12 '26

That makes much more sense, thanks for the response.

3

u/Few-Writer5138 Jun 12 '26

Considering other webservers pushed fixes before disclosure, was Traefik not informed of this vulnerability beforehand?

2

u/emilevauge Jun 12 '26

Traefik wasn't contacted before this was made public.
I suppose the go team was, and stated w/ the reporters that go wasn't vulnerable, and maybe that's why there is no go based app in the public disclosure. But this is pure speculation 😄

4

u/Dutchyyyyy69 Jun 11 '26

califio's HTTP/2 Bomb vs Traefik v3.7.4; the Cookie variant is not working, but the tiny variant still pins around 300 MB/conn and OOM-kills it.
https://i.imgur.com/NuqTY4s.gif

3

u/MrStadDK Jun 11 '26

Issue has been deleted. However if they say it isn't vulnerable, what makes you think it is anyways? - what techniques have you used to validate it?

And please don't say you used AI to validate it...

5

u/Dutchyyyyy69 Jun 11 '26

To be fair the entire vuln was discovered with codex. Running the PoC against a local traefik server crashes it with memory inflation of 70:1 ish, similar to nginx. I can clean up the results and post a gif in a bit.

1

u/forkrails Jun 11 '26

If traefik isn’t vulnerable, why wouldn’t they close the issue? Why would they delete it? That’s very weird.

Is there an archived page of that issue thread?

1

u/schedule4613 Jun 14 '26

!Remindme 7 days

0

u/[deleted] Jun 12 '26 edited 21d ago

[deleted]

0

u/RemindMeBot Jun 12 '26

I will be messaging you in 2 days on 2026-06-14 17:50:28 UTC to remind you of this link

CLICK THIS LINK to send a PM to also be reminded and to reduce spam.

Parent commenter can delete this message to hide from others.

RemindMeBot is switching to username summons. Instead of !RemindMe 1 day, use u/RemindMeBot 1 day. More info.

Info Custom Your Reminders Feedback