GitHub Advisoryadvisory · Go

GHSA-4hjq-9h5c-252j Traefik: HTTP/2 frames can cause a running server to panic

HIGH Published 2026-03-12 Modified 2026-03-12 Official page ↗

Ecosystem: Go
Packages: github.com/traefik/traefik/v2, github.com/traefik/traefik/v3
Severity: High
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H
Weaknesses: CWE-476
Reviewed: 2026-03-12

Affected packages

• Go github.com/traefik/traefik/v2: < 2.11.40 → fixed in 2.11.40 • Go github.com/traefik/traefik/v3: < 3.6.10 → fixed in 3.6.10

Description

Summary More Details: • https://nvd.nist.gov/vuln/detail/CVE-2026-27141 • https://pkg.go.dev/golang.org/x/net/http2?tab=versions Patches • https://github.com/traefik/traefik/releases/tag/v3.6.10 • https://github.com/traefik/traefik/releases/tag/v2.11.40 For more information If you have any questions or comments about this advisory, please open an issue.

Related

Weakness · CWE (1)

CWE-476 NULL Pointer Dereference weakness

References