EUVD-2026-75578

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sanitization, forwardAuth,...

CVE-2026-88008 Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend accepts h2c and returns 101 Switching...

EUVD-2026-75545

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend accepts h2c and returns 101 Switching...

CVE-2026-88008

Traefik (open-source HTTP reverse proxy and load balancer) is vulnerable to a middleware bypass via unrestricted client-initiated Upgrade: h2c forwarding. Versions 2.11.26–2.11.56 , 3.7.0–3.7.12 , and EOL 3.4.2–3.6 are affected. When a shared backend accepts the h2c upgrade and returns 101 Switch...

CVE-2026-88008 Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend accepts h2c and returns 101 Switching...

CVE-2026-88007

Traefik versions 2.11.0 through 2.11.57 and 3.7.13 contain a backend connection reuse flaw in the HTTP/3 entrypoint. The ConnContext does not call service.AddTransportOnContext, causing kerberosRoundTripper to share a single backend transport across all frontend connections rather than using a de...

EUVD-2026-75538

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an unauthenticated client to submit an aliasing or trusted...

CVE-2026-88004

Traefik (open source HTTP reverse proxy and load balancer) versions 3.2.0 through 3.7.12 have a header sanitization bypass. The entrypoint defenses aliasHeadersStrategy , underscoreHeadersStrategy , and forwardedHeaders inspect only req.Header but not req.Trailer. An unauthenticated client can pl...

CVE-2026-88004 Traefik entrypoint header-name sanitization bypassed via request trailers

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an unauthenticated client to submit an aliasing or trusted...

CVE-2026-88004 Traefik entrypoint header-name sanitization bypassed via request trailers

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an unauthenticated client to submit an aliasing or trusted...

CVE-2026-88004 Traefik entrypoint header-name sanitization bypassed via request trailers

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an unauthenticated client to submit an aliasing or trusted...

CVE-2026-88879

Traefik (HTTP reverse proxy and load balancer) is vulnerable to identity spoofing via dot-form header aliasing in versions v1.x, v2.x–v2.11.55, and v3.0.0–v3.7.11. Because Go canonicalizes header names on dashes only, a client can send a dot-form alias (e.g., X.Authenticated.User) alongside the c...

CVE-2026-88879 Traefik before v2.11.56 Identity Spoofing via Header Alias

Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, XAuthUser and X.Auth.User are treated as three distinct headers by Traefik, while backends that derive variable...

CVE-2026-88879 Traefik before v2.11.56 Identity Spoofing via Header Alias

Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, XAuthUser and X.Auth.User are treated as three distinct headers by Traefik, while backends that derive variable...

CVE-2026-88877 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect

Traefik is a HTTP reverse proxy and load balancer. In versions = v3.7.0 and = v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creat...

MobSF_AI

MobSF AI Sidecar This project adds an AI-powered chat assistant to the Mobile Security Framework MobSF. It allows security analysts to ask questions about the analysis report generated by MobSF directly within the interface, leveraging OpenAI's model. Features Seamless Integration : Injects a...

PT-2026-89459

Summary There is a high-severity request-smuggling vulnerability in Traefik's handling of the HTTP/1.1 Upgrade mechanism. Since Traefik moved to unencrypted HTTP/2 with prior knowledge Go 1.24, a client-initiated Upgrade: h2c request header and its connection-specific HTTP2-Settings header were...

PT-2026-89452

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an unauthenticated client to submit an aliasing or trusted...

PT-2026-89472

Summary There is a medium severity vulnerability in Traefik's handling of request headers whose name aliases another header name. Go canonicalizes header names on dashes only, so X-Auth-User, X Auth User and X.Auth.User are three distinct headers to Traefik, while backends that derive variable...

CVE-2026-73276

A flaw was found in the Erlang/OTP inets httpd server. This vulnerability allows a remote attacker to perform HTTP Request Smuggling due to the server silently dropping HTTP headers that contain whitespace between the header field-name and the colon. When deployed behind a reverse proxy that...