CVE-2026-114641
Description
A flaw was found in Traefik. A remote attacker can exploit a race condition in backend authentication handling by sending concurrent HTTP/2 or HTTP/3 requests over a single connection. This flaw can cause Traefik to crash, resulting in a Denial of Service (DoS), or disrupt connection-bound authentication and orphan backend connections.
Statement
This vulnerability is rated as having Low impact because successful exploitation requires specific environmental prerequisites—multiplexed HTTP/2 or HTTP/3 connections forwarded to backends utilizing NTLM or Kerberos authentication—and the outcome is limited to service interruption or orphaned connections without compromising data confidentiality or integrity. Additionally, Traefik is not distributed as part of Red Hat Enterprise Linux, restricting exposure to unsupported or user-managed workloads operating on Red Hat infrastructure.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Other
Technical Impact: Modify Application Data; Read Application Data; Alter Execution Logic
If access to a shared resource is not synchronized, then the resource may not be in a state that is expected by the product. This might lead to unexpected or insecure behaviors, especially if an attacker can influence the shared resource.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
