A flaw in Traefik’s ForwardAuth middleware causes the proxy to read the entire authentication server response body into memory without any size limit. If the authentication server supplies a very large or unbounded body, Traefik will consume unlimited memory, eventually triggering an out-of-memory condition that crashes the process. The crash results in service disruption for all routes handled by the affected Traefik instance. This vulnerability represents an uncontrolled resource consumption weakness, allowing denial of service if an attacker can influence the size of the response from an auth server.

The vulnerability affects the open-source HTTP reverse proxy and load balancer known as Traefik, specifically versions prior to 2.11.38 and 3.6.9. Users running any deployment of Traefik that employs the ForwardAuth middleware without a configured maximum response body size are at risk. The affected packages are identified by the CNA as traefik:traefik.

The issue is scored at CVSS 4.4, indicating moderate overall severity. The EPSS probability is less than 1%, reflecting a very low likelihood of active exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to host or control an authentication server served to the Traefik instance and craft an unusually large response body; this makes the attack scenario dependent on the ability to influence the auth server’s output. Once triggered, the resulting OOM causes a process crash and simultaneous denial of service to all routes handled by the vulnerable Traefik process.