Traefik Labs Traefik authorization issue vulnerability

Traefik Labs Traefik versions prior to 2.11.58 and prior to 3.7.14 contain an authorization issue vulnerability. This vulnerability arises because SNI checks are skipped when the TLS state is nil in requests, resulting in authentication bypass. Unauthenticated clients can send HTTP/2 requests...

Fixed in Apache Tomcat 10.1.53

Moderate: The fix forCVE-2025-66614 was incomplete CVE-2026-32990 The validation of SNI name and host name did not take account of possible differences in case allowing the strict SNI checks to be bypassed. This was fixed with commit 4d0615a5. This issue was reported to the Tomcat security team o...