CVE-2023-47124

    Dashboard / Vulnerabilities / CVE-2023-47124

    CVE-2023-47124

    Published: 4 Dec 2023Last Modified: 21 Oct 2026

    Summary: Denial of service whith ACME HTTPChallenge in Traefik

    Details: Traefik is an open source HTTP reverse proxy and load balancer. When Traefik is configured to use the `HTTPChallenge` to generate and renew the Let's Encrypt TLS certificates, the delay authorized to solve the challenge (50 seconds) can be exploited by attackers to achieve a `slowloris attack`. This vulnerability has been patch in version 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. Users unable to upgrade should replace the `HTTPChallenge` with the `TLSChallenge` or the `DNSChallenge`.

    References: https://doc.traefik.io/traefik/https/acme/#dnschallenge, https://doc.traefik.io/traefik/https/acme/#httpchallenge, https://doc.traefik.io/traefik/https/acme/#tlschallenge, https://github.com/traefik/traefik/releases/tag/v2.10.6, https://github.com/traefik/traefik/releases/tag/v3.0.0-beta5, https://www.cloudflare.com/learning/ddos/ddos-attack-tools/slowloris, ttps://www.cloudflare.com/learning/ddos/ddos-attack-tools/slowloris/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47124.json, https://github.com/traefik/traefik/security/advisories/GHSA-8g85-whqh-cr2f, https://nvd.nist.gov/vuln/detail/CVE-2023-47124

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    3.0.0-beta1
    3.0.0-beta2
    3.0.0-beta3
    3.0.0-beta4

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High