Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Summary There is a critical vulnerability in Traefik's default HTTP reverse proxy that leads to unauthenticated cross-user response poisoning. When a client opens an HTTP/2 or HTTP/3 CONNECT request, Traefik forwards it — body included — to an HTTP/1.1 upstream over a shared net/http.Transport. I...

EUVD-2026-54288

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNE...

CVE-2026-71324

CVE-2026-71324 (Traefik) : Unauthenticated cross-user response poisoning via proxied CONNECT on Traefik’s shared backend keep-alive pool. Traefik forwards HTTP/2/HTTP/3 CONNECT and its body to an HTTP/1.1 upstream through a shared net/http.Transport. If the upstream returns a keep-alive non-2xx a...