The reported flaw is a data race in Traefik’s experimental FastProxy component that can be triggered via HTTP/1 protocol upgrade requests. An unauthenticated attacker can repeatedly open and abort upgraded connections, such as WebSocket, corrupting an unsynchronized shared bufio.Reader. This causes an unrecovered panic that aborts the Traefik process, resulting in a denial‑of‑service condition. The weakness is a concurrency error, identified as CWE‑567, and poses no risk of code execution or data disclosure.

Traefik releases from 3.2.0 up to, but not including, 3.7.15 are affected. The product is a reverse‑proxy and load‑balancer used in many containerized environments. Any deployment that uses the experimental FastProxy feature in those versions is vulnerable unless the feature is disabled or the software upgraded.

The vulnerability carries a CVSS score of 8.2, indicating high severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, but the lack of authentication and the ability to trigger a panic via standard HTTP requests make it a potentially low‑effort attack. If a remote client can reach the FastProxy endpoint, it can exploit the race condition without special privileges, leading to repeated process restarts and service unavailability. The attack vector is inferred to be remote over the public network unless protected by internal firewalls.