Traefik CVE-2026-119574

Exploitation requires the experimental FastProxy feature to be explicitly enabled (experimental.fastProxy); default Traefik deployments and all Traefik v2 are NOT affected. The targeted route must terminate in a backend that performs HTTP/1 protocol upgrades such as WebSocket (101 Switching Protocols), since the race is on the shared buffered reader after an upgrade. The attacker needs no authentication (PR:N) and no user interaction (UI:N), but must repeatedly open and abort upgraded connections to win the data race (reflected as AT:P / AC:H) - a single request is not sufficient. Limiting factors: non-default feature flag, dependence on an upgrade-capable backend route, and the probabilistic nature of the race. Affected versions v3.2-v3.6 are end-of-life and receive no patch; the only complete fix per the advisory is upgrading to v3.7.15.

This is a real but conditional priority. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) and the advisory agree that an unauthenticated network attacker can trigger the flaw, and impact is availability-only (VA:H; VC:N/VI:N) - a process crash, not code execution or data exposure. The vuln.today decision label is 'this_week' (not act_now/emergency), which fits the profile: serious DoS, remotely reachable, but gated by a non-default feature. The AT:P ('attack requirement') maps to the data race described in the advisory - the attacker must repeatedly open and abort upgraded connections to win the race on the unsynchronized bufio.Reader, so a single request does not reliably crash the process; this is a genuine race (CWE-567) as the evidence states, not a deterministic single-shot trigger. Key signals that temper raw severity: there is NO CISA KEV listing and NO EPSS score in the provided data, and no confirmed public exploit code - so there is no evidence of active exploitation. Most importantly, only deployments with experimental.fastProxy explicitly enabled are affected, which is not the default. Net: credible, remotely exploitable availability risk for the subset of deployments using FastProxy; low urgency for everyone else. No conflicting signals in the input, but exploitation likelihood in the wild is unverified.

An attacker reachable at a Traefik instance running experimental FastProxy sends requests that reach a backend performing HTTP/1 protocol upgrades (e.g., a WebSocket endpoint). By repeatedly opening these upgraded connections and aborting them, the attacker races the connection pool against the tunnel copier on the same unsynchronized bufio.Reader, corrupting its state and triggering an unrecovered panic that kills the Traefik process. No authentication is required; no public exploit code is identified at time of analysis, though a VulnCheck advisory documents the technique.