1677 matches found
CVE-2026-88012
A flaw was found in Traefik, an open-source HTTP reverse proxy and load balancer. Its HTTP/3 entrypoints do not correctly apply read timeouts, which are intended to prevent prolonged connections. An unauthenticated client can exploit this by sending a slow request body, continuously trickling dat...
CVE-2026-88008
A flaw was found in Traefik, an open source HTTP reverse proxy and load balancer. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP/2 request that includes specific upgrade headers. If the backend server accepts the upgrade, Traefik enters a raw...
CVE-2026-88007
A flaw in Traefik's HTTP/3 ConnContext allows unauthenticated remote attackers to bypass authentication on backends using connection-bound NTLM or Negotiate protocols. Missing service.AddTransportOnContext calls lead to shared kerberosRoundTripper transports, enabling attackers to hijack persiste...
CVE-2026-88010 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle
Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...
EUVD-2026-84532
Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...
CVE-2026-88010 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle
Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...
CVE-2026-88010 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle
Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...
CVE-2026-88010
Traefik (open source HTTP reverse proxy and load balancer) versions 3.6.11 through before 3.7.13 contain an unauthenticated username-enumeration timing oracle in the BasicAuth middleware. The checkPassword function in pkg/middlewares/auth/basic_auth.go constructs the singleflight key from the sub...
CVE-2026-88009
A flaw was found in Traefik, an open source HTTP reverse proxy and load balancer. This vulnerability allows a remote attacker to bypass security controls by sending a specially crafted HTTP/1 request. The request target is incorrectly processed, leading to cross-vhost routing bypass, path-scoped...
CVE-2026-88010: Observable Timing Discrepancy
Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...
PT-2026-96813
Name of the Vulnerable Software and Affected Versions Traefik versions 3.6.11 through 3.7.12 Description An unauthenticated timing discrepancy exists in the checkPassword function within pkg/middlewares/auth/basic auth.go. The issue occurs because the BasicAuth singleflight key is constructed usi...
SUSE CVE-2026-88004
Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an unauthenticated client to submit an aliasing or trusted...
SUSE CVE-2026-88007
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection...
SUSE CVE-2026-88008
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend accepts h2c and returns 101 Switching...
SUSE CVE-2026-88009
Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sanitization, forwardAuth,...
SUSE CVE-2026-88011
Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User...
SUSE CVE-2026-88012
Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream...
CLEANSTART-2026-VN90217 OpenTelemetry-Go is the Go implementation of OpenTelemetry
Security vulnerability affects the traefik package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...
FreeBSD : traefik -- Multiple vulnerabilities (0627020f-b21c-11f1-bc39-5404a68ad561)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0627020f-b21c-11f1-bc39-5404a68ad561 advisory. The traefik project releases a new version addressing multiple vulnerabilities: Tenable has extracted t...