GHSA-4hjq-9h5c-252j: Traefik HTTP/2 Frames Can Cause A Vulnerability
HIGHGHSA-4hjq-9h5c-252j is a HIGH http/2 frames can cause a vulnerability (CWE-476: NULL Pointer Dereference) affecting Traefik libraries in the Go ecosystem. The issue involves http/2 frames can cause a running server to panic. Remediation is available by upgrading affected packages to version 2.11.40, 3.6.10.
GHSA-4hjq-9h5c-252j at a Glance
How to Fix GHSA-4hjq-9h5c-252j
To remediate this vulnerability, upgrade all affected Traefik dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/traefik/traefik/v2 to 2.11.40Upgrade github.com/traefik/traefik/v3 to 3.6.10Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/traefik/traefik/v2How to Check if You Are Affected
To determine whether your application is affected by GHSA-4hjq-9h5c-252j, inspect your project dependencies for Traefik:
inspect dependencies for github.com/traefik/traefik/v2Analyze the terminal output to locate any version of Traefik in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.11.40), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-476: NULL Pointer Dereference, where the product dereferences a pointer that it expects to be valid but is null. In Traefik, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-4hjq-9h5c-252j Affected Traefik Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/traefik/traefik/v2
|
Go |
< 2.11.40
|
2.11.40
|
|
github.com/traefik/traefik/v3
|
Go |
< 3.6.10
|
3.6.10
|
References
Frequently Asked Questions
What is GHSA-4hjq-9h5c-252j?
Which Traefik versions are affected?
What version fixes GHSA-4hjq-9h5c-252j?
Is github.com/traefik/traefik/v2 affected?
Is github.com/traefik/traefik/v3 affected?
What CWE is associated with GHSA-4hjq-9h5c-252j?
How can I check Go dependencies for GHSA-4hjq-9h5c-252j?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-4hjq-9h5c-252j",
"modified" : "2026-03-12T14:48:02Z",
"published" : "2026-03-12T14:48:02Z",
"aliases" : [ ],
"summary" : "Traefik: HTTP/2 frames can cause a running server to panic",
"details" : "## Summary\n\nMore Details:\n- https://nvd.nist.gov/vuln/detail/CVE-2026-27141\n- https://pkg.go.dev/golang.org/x/net/http2?tab=versions\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.6.10\n- https://github.com/traefik/traefik/releases/tag/v2.11.40\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/traefik/traefik/v2"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "2.11.40"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 2.11.39"
}
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/traefik/traefik/v3"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "3.6.10"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 3.6.9"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/traefik/traefik/security/advisories/GHSA-4hjq-9h5c-252j"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/traefik/traefik"
}, {
"type" : "WEB",
"url" : "https://github.com/traefik/traefik/releases/tag/v2.11.40"
}, {
"type" : "WEB",
"url" : "https://github.com/traefik/traefik/releases/tag/v3.6.10"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-476" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-03-12T14:48:02Z",
"nvd_published_at" : null
}
}