CVE-2026-119574
Description
A flaw was found in Traefik. A race condition in the FastProxy component allows an unauthenticated remote attacker to cause a Denial of Service (DoS). By repeatedly opening and aborting upgraded protocol connections, such as WebSockets, an attacker can corrupt shared internal buffers, triggering a crash that terminates the Traefik process.
Statement
This vulnerability is rated as Moderate because it exclusively results in a denial of service without compromising host data, and exploitation depends on winning a race condition during connection handshakes. Red Hat products do not package or distribute Traefik, meaning standard enterprise installations remain unaffected. Exposure is limited to third-party or standalone deployments where the non-default, experimental FastProxy capability is enabled.
Understanding the Weakness (CWE)
Integrity,Other
Technical Impact: Alter Execution Logic; Unexpected State
The main problem is that -- if a lock is overcome -- data could be altered in a bad state.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
