CVE-2026-29054 Traefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)

Traefik is an HTTP reverse proxy and load balancer. From version 2.11.9 to 2.11.37 and from version 3.1.3 to 3.6.8, there is a potential vulnerability in Traefik managing the Connection header with X-Forwarded headers. When Traefik processes HTTP/1.1 requests, the protection put in place to preve...

PT-2026-23092

Name of the Vulnerable Software and Affected Versions Traefik versions 2.11.9 through 2.11.37 Traefik versions 3.1.3 through 3.6.8 Description Traefik, an HTTP reverse proxy and load balancer, has an issue in how it manages the Connection header in conjunction with X-Forwarded headers. When...