SUSE CVE-2026-114642

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backe...

CVE-2026-114642

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backe...

EUVD-2026-107897

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backe...

CVE-2026-114642 Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backe...

CVE-2026-114642 Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backe...

CVE-2026-114642

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backe...

CVE-2026-114642

Traefik versions 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 are vulnerable to a TLS configuration bypass . The root cause is that the NTLM/Kerberos backend round tripper is stored in a client-connection slot not keyed by ServersTransport, causing one service's TLS configuration to be reused fo...

CVE-2026-114642 Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backe...

PT-2026-120937

Name of the Vulnerable Software and Affected Versions Traefik versions 2.11.0 through 2.11.57 Traefik versions 3.0.0 through 3.7.13 Description The software stores its NTLM/Kerberos backend round tripper in a client-connection slot that is not keyed by ServersTransport. This causes the TLS client...

Traefik Labs Traefik encryption issue vulnerability

Traefik Labs Traefik versions prior to 2.11.0 and 2.11.58, as well as versions prior to 3.0.0 and 3.7.14, contain an encryption-related vulnerability. This vulnerability arises because the NTLM/Kerberos backend round tripper is stored in a client connection slot that lacks the “ServersTransport”...

GHSA-8H4C-X2WG-6XP8 Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

Summary Ember's HTTP/1.1 request parser does not reject a message that carries both a Transfer-Encoding and a Content-Length header. RFC 9112 §6.1 requires a server to treat such a message as a framing error and close the connection. An intermediary that follows the RFC's CL-strip-and-forward pat...

CentOS 9 : nghttp2-1.43.0-8.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the nghttp2-1.43.0-8.el9 build changelog. - nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling through the CONNECT handling path and the shared backend transport. An attacker can make another client read attacker-smuggled backend output by sending an HTTP/2 or HTTP/3 CONNECT request with a body that Traefik...

Exposure of Data Element to Wrong Session

Overview org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine. Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session due to the connection-scoped trailers handling in the HTTP/1.1 request processing path. ...

CVE-2026-39805

Inconsistent Interpretation of HTTP Requests vulnerability in mtrudel bandit allows HTTP request smuggling via duplicate Content-Length headers. 'Elixir.Bandit.Headers':getcontentlength/1 in lib/bandit/headers.ex uses List.keyfind/3, which returns only the first matching header. When a request...

UBUNTU-CVE-2026-1760

A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine Transfer-Encoding: chunked and Connection: keep-alive headers. A remote, unauthenticated client can exploit this by sending specially crafted requests,...

Async-h1 request smuggling possible with long unread bodies

Impact This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the body of a request which is longer than some buffer length, async-h1 will attempt to read a subsequent request from the body content...

GHSA-4VR9-8CJF-VF9C Async-h1 request smuggling possible with long unread bodies

Impact This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the body of a request which is longer than some buffer length, async-h1 will attempt to read a subsequent request from the body content...

Denial Of Service (DoS)

varnish cache is vulnerable to denial of service. A remote attacker is able to crash the application by sending malicious HTTP/1 requests processed on the same HTTP/1 keep-alive connection. This causes Varnish to restart with a clean cache, resulting in a denial of service condition...

CVE-2020-26281

async-h1 is an asynchronous HTTP/1.1 parser for Rust crates.io. There is a request smuggling vulnerability in async-h1 before version 2.3.0. This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the bo...