{"id":"GHSA-f7cq-5v43-8pwp","aliases":["GO-2024-2880"],"status":"published","title":"Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop","description":"### Impact\n\nThere is a vulnerability in [GO managing malformed DNS message](https://groups.google.com/g/golang-announce/c/wkkO4P9stm0), which impacts Traefik.\nThis vulnerability could be exploited to cause a denial of service.\n\n### References\n\n- [CVE-2024-24788](https://www.cve.org/CVERecord?id=CVE-2024-24788)\n\n### Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.3\n- https://github.com/traefik/traefik/releases/tag/v3.0.1\n\n### Workarounds\n\nNo workaround.\n\n### For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1395"],"published":"2024-05-23T15:19:41Z","modified":"2026-08-07T08:12:26Z","fixes":[{"ecosystem":"Go","package":"github.com/traefik/traefik/v2","fixed_in":["2.11.3"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/traefik/traefik/v3","fixed_in":["3.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/traefik/traefik/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/traefik/traefik/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/traefik/traefik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.7.34"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/traefik/traefik/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.11.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/traefik/traefik/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/traefik/traefik","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.7.34"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/traefik/traefik","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/traefik/traefik/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.11.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/traefik/traefik/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}]}],"references":[{"url":"https://github.com/traefik/traefik/security/advisories/GHSA-f7cq-5v43-8pwp","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-5fq7-4mxc-535h","tags":["advisory","web"]},{"url":"https://github.com/traefik/traefik/releases/tag/v2.11.3","tags":["web"]},{"url":"https://github.com/traefik/traefik/releases/tag/v3.0.1","tags":["web"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24788","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f7cq-5v43-8pwp"},{"url":"https://github.com/traefik/traefik","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-f7cq-5v43-8pwp","title":"Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop","description":"### Impact\n\nThere is a vulnerability in [GO managing malformed DNS message](https://groups.google.com/g/golang-announce/c/wkkO4P9stm0), which impacts Traefik.\nThis vulnerability could be exploited to cause a denial of service.\n\n### References\n\n- [CVE-2024-24788](https://www.cve.org/CVERecord?id=CVE-2024-24788)\n\n### Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.3\n- https://github.com/traefik/traefik/releases/tag/v3.0.1\n\n### Workarounds\n\nNo workaround.\n\n### For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","status":"published","published":"2024-05-23T15:19:41Z","modified":"2024-05-23T15:19:43Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T14:37:51.549437Z"}],"osv":[{"id":"GHSA-f7cq-5v43-8pwp","title":"Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop","description":"### Impact\n\nThere is a vulnerability in [GO managing malformed DNS message](https://groups.google.com/g/golang-announce/c/wkkO4P9stm0), which impacts Traefik.\nThis vulnerability could be exploited to cause a denial of service.\n\n### References\n\n- [CVE-2024-24788](https://www.cve.org/CVERecord?id=CVE-2024-24788)\n\n### Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.3\n- https://github.com/traefik/traefik/releases/tag/v3.0.1\n\n### Workarounds\n\nNo workaround.\n\n### For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","status":"published","published":"2024-05-23T15:19:41Z","modified":"2026-08-07T08:12:19.967086309Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"GO-2024-2880","title":"Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop in github.com/traefik/traefik","description":"Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop in github.com/traefik/traefik","status":"published","published":"2024-06-05T15:10:42Z","modified":"2026-08-07T08:12:26.571703688Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}