traefik-3.6.10-1.1 on GA media (moderate)

traefik-3.6.10-1.1 on GA media Announcement ID: openSUSE-SU-2026:10323-1 Rating: moderate Cross-References: CVE-2026-26998 CVE-2026-26999 CVE-2026-29054 Affected Products: openSUSE Tumbleweed An update that solves 3 vulnerabilities can now be installed. Description: These are all security issues...

CVE-2026-26998

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. When Traefik is configured to use the ForwardAuth middleware, it reads the authentication server's response body into memory without a size limit. A malicious or misconfigured authentication server could send an excessively lar...

CVE-2026-26998 Traefik: unbounded io.ReadAll on auth server response body causes OOM denial of service(DOS)

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing the ForwardAuth middleware responses. When Traefik is configured to use the ForwardAuth middleware, the response body from the authentication server is...

CVE-2026-26998

creationtimestamp| type| source ---|---|--- 2026-03-04 13:09:56+00:00| published-proof-of-concept| https://github.com/traefik/traefik/security/advisories/GHSA-fw45-f5q2-2p4x 2026-03-05 14:20:14+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mgcyldb6z52q...