« Volver al listado

CVE-2022-39271

Estado: ModificadaAlta (7.5)—

Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that assists in deploying microservices. There is a potential vulnerability in Traefik managing HTTP/2 connections. A closing HTTP/2 server connection could hang forever because of a subsequent fatal error. This failure mode could be exploited to cause a denial of service. There has been a patch released in versions 2.8.8 and 2.9.0-rc5. There are currently no known workarounds.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Traefik — Traefik

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-39271",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-39271",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-23T15:50:09.653301Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "traefik",
          "product": "traefik",
          "versions": [
            {
              "status": "affected",
              "version": " < 2.8.8"
            },
            {
              "status": "affected",
              "version": ">= 2.9.0-rc1, < 2.9.0-rc5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-10-11T14:15:09.883",
  "references": [
    {
      "url": "https://github.com/traefik/traefik/releases/tag/v2.8.8",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/traefik/traefik/releases/tag/v2.9.0-rc5",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-c6hx-pjc3-7fqr",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/traefik/traefik/releases/tag/v2.8.8",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/traefik/traefik/releases/tag/v2.9.0-rc5",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-c6hx-pjc3-7fqr",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-755"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that assists in deploying microservices. There is a potential vulnerability in Traefik managing HTTP/2 connections. A closing HTTP/2 server connection could hang forever because of a subsequent fatal error. This failure mode could be exploited to cause a denial of service. There has been a patch released in versions 2.8.8 and 2.9.0-rc5. There are currently no known workarounds."
    },
    {
      "lang": "es",
      "value": "Traefik (pronunciado tráfico) es un moderno proxy inverso HTTP y equilibrador de carga que ayuda a desplegar microservicios. Se presenta una vulnerabilidad potencial en Traefik al administrar las conexiones HTTP/2. Una conexión de servidor HTTP/2 que es cerrada podría colgarse para siempre debido a un error fatal posterior. Este modo de fallo podría ser explotado para causar una denegación de servicio. Ha sido publicado un parche en versiones 2.8.8 y 2.9.0-rc5. Actualmente no se presentan mitigaciones conocidas"
    }
  ],
  "lastModified": "2026-06-17T04:58:02.643",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC4B4129-B55E-49A3-AC70-58189BF6F4E9",
              "versionEndExcluding": "2.8.8"
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:2.9.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FCCE16AF-C4D4-4214-BD57-5F45CA12B84B"
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:2.9.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B462AF00-590B-400C-B219-685BBC1E16AB"
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:2.9.0:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45A346C6-2494-4C72-A606-746554E933B5"
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:2.9.0:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD36BBFB-A14F-4B93-95B6-83FC5C67F4B9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}