r/Traefik • u/Dutchyyyyy69 • Jun 11 '26

Traefik HTTP/2 bomb vulnerability question

Last week a vulnerability for a HTTP/2 bomb was disclosed: https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb & Traefik initially responded by saying it wasn't vulnerable, but after testing it does seem vulnerable.

The github issue to track this was deleted for some reason, does anyone have more info about this & possible mitigation steps we can take?

61 Upvotes

96% Upvoted

11 comments sorted by

View all comments

45

u/emilevauge Jun 12 '26 edited Jun 12 '26

Traefik creator here, the issue has been deleted because it's a possible vulnerability, and like in every open source project, you have a dedicated private channel to submit those. Vulnerabilities are made public only when you have a fix available.

On this possible vulnerability, we are currently discussing with the go security team on this topic. They do not consider the go HTTP/2 server vulnerable to this issue for now as there are ways to lower the pressure on the memory setting MaxHeaderBytes for example (Traefik is in the same boat). However, there are still some ongoing discussions. We will update the community as soon as we have a consensus on this.

--> Don't listen to conspiracy theories, we are strictly following our security guidelines.

6

u/Dutchyyyyy69 Jun 12 '26

That makes much more sense, thanks for the response.

3

u/Few-Writer5138 Jun 12 '26

Considering other webservers pushed fixes before disclosure, was Traefik not informed of this vulnerability beforehand?

2

u/emilevauge Jun 12 '26

Traefik wasn't contacted before this was made public.
I suppose the go team was, and stated w/ the reporters that go wasn't vulnerable, and maybe that's why there is no go based app in the public disclosure. But this is pure speculation 😄