CVE-2026-71326

A flaw was found in Traefik. The BasicAuth middleware in Traefik reuses a key for concurrent password checks, which is generated by concatenating the password and secret without a delimiter. An attacker with a valid credential and the corresponding stored hash can exploit this vulnerability to...

CVE-2026-71326: Improper Authentication

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basicauth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and...

SUSE CVE-2026-33433

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when headerField is configured with a non-canonical HTTP header name e.g., x-auth-user instead of X-Auth-User, an authenticated attacker can inject their own canonical version of that header to...

CVE-2026-33433 Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when headerField is configured with a non-canonical HTTP header name e.g., x-auth-user instead of X-Auth-User, an authenticated attacker can inject their own canonical version of that header to...

CVE-2026-33433

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when headerField is configured with a non-canonical HTTP header name e.g., x-auth-user instead of X-Auth-User, an authenticated attacker can inject their own canonical version of that header to...

CVE-2026-33433

CVE-2026-33433 affects Traefik prior to 2.11.42, 3.6.11, and 3.7.0-ea.3. A vulnerability in the BasicAuth/DigestAuth middlewares arises when headerField is configured with a non-canonical HTTP header name (for example x-auth-user). An authenticated attacker can inject a canonical version of that ...

CVE-2026-33433: Authentication Bypass by Spoofing

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when headerField is configured with a non-canonical HTTP header name e.g., x-auth-user instead of X-Auth-User, an authenticated attacker can inject their own canonical version of that header to...

pcapplusplus:FuzzTargetNg: Use-of-uninitialized-value in pcpp::HeaderField::HeaderField

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=6521259027660800 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTargetNg Job Type: libfuzzermsanpcapplusplus Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

pcapplusplus:FuzzTargetNg: Use-of-uninitialized-value in pcpp::HeaderField::HeaderField

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=4899165265264640 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTargetNg Job Type: libfuzzermsanpcapplusplus Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

PT-2026-28482

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.11.42 Traefik versions prior to 3.6.12 Traefik versions prior to 3.7.0-ea.3 Description Traefik, an HTTP reverse proxy and load balancer, is susceptible to an identity impersonation issue. When the headerField...

pcapplusplus:FuzzTarget: Crash in pcpp::HeaderField::HeaderField

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=5599853057802240 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTarget Job Type: libfuzzerubsanpcapplusplus Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

OSV-2020-1152 Heap-buffer-overflow in pcpp::tbp_my_own_strnlen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22483 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::tbpmyownstrnlen pcpp::HeaderField::HeaderField pcpp::TextBasedProtocolMessage::parseFields...

OSV-2020-973 Heap-buffer-overflow in pcpp::HeaderField::HeaderField

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22837 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::HeaderField::HeaderField pcpp::TextBasedProtocolMessage::parseFields pcpp::SipResponseLayer::SipResponseLayer...

OSV-2020-943 Heap-buffer-overflow in pcpp::HeaderField::HeaderField

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22528 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::HeaderField::HeaderField pcpp::TextBasedProtocolMessage::parseFields pcpp::SipResponseLayer::SipResponseLayer...

PT-2020-22639

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 1 crash has been reported. The crash occurs in the pcpp::HeaderField::HeaderField function, which is called by...

PT-2020-22653

Name of the Vulnerable Software and Affected Versions No specific software or version information is provided in the given input. Description A heap-buffer-overflow READ 1 crash has been reported. The crash occurs in the pcpp::HeaderField::HeaderField function, which is called by...

PT-2020-21731

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 1 crash has been reported. The crash involves the pcpp::tbp my own strnlen, pcpp::HeaderField::HeaderField, and...

PT-2020-22537

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow read crash has been reported. The crash involves the libcpp memchr and memchr functions, and is related to the...

OSV-2020-45 Use-of-uninitialized-value in pcpp::tbp_my_own_strnlen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22829 Crash type: Use-of-uninitialized-value Crash state: pcpp::tbpmyownstrnlen pcpp::HeaderField::HeaderField pcpp::TextBasedProtocolMessage::parseFields...

PT-2020-22333

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash caused by the use of an uninitialized value. The crash occurs in the pcpp::tbp my own strnlen function, which is called by...