GHSA-92MV-8F8W-WQ52 traefik CVE-2024-45410 fix bypass: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)

Impact There is a potential vulnerability in Traefik managing the Connection header with X-Forwarded headers. When Traefik processes HTTP/1.1 requests, the protection put in place to prevent the removal of Traefik-managed X-Forwarded headers such as X-Real-Ip, X-Forwarded-Host, X-Forwarded-Port,...

GHSA-XW98-5Q62-JX94 Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (Slowloris DOS)

Impact There is a potential vulnerability in Traefik managing TLS handshake on TCP routers. When Traefik processes a TLS connection on a TCP router, the read deadline used to bound protocol sniffing is cleared before the TLS handshake is completed. When a TLS handshake read error occurs, the code...

Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (Slowloris DOS)

Impact There is a potential vulnerability in Traefik managing TLS handshake on TCP routers. When Traefik processes a TLS connection on a TCP router, the read deadline used to bound protocol sniffing is cleared before the TLS handshake is completed. When a TLS handshake read error occurs, the code...

GHSA-FW45-F5Q2-2P4X Traefik has unbounded io.ReadAll on auth server response body that causes OOM DOS

Impact There is a potential vulnerability in Traefik managing the ForwardAuth middleware responses. When Traefik is configured to use the ForwardAuth middleware, the response body from the authentication server is read entirely into memory without any size limit. There is no maxResponseBodySize...

Traefik has unbounded io.ReadAll on auth server response body that causes OOM DOS

Impact There is a potential vulnerability in Traefik managing the ForwardAuth middleware responses. When Traefik is configured to use the ForwardAuth middleware, the response body from the authentication server is read entirely into memory without any size limit. There is no maxResponseBodySize...

PT-2026-23084

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.11.38 and versions prior to 3.6.9 Description Traefik, an HTTP reverse proxy and load balancer, has an issue in its handling of TLS handshakes on TCP routers. The read deadline used for protocol sniffing is cleared...

PT-2026-23092

Name of the Vulnerable Software and Affected Versions Traefik versions 2.11.9 through 2.11.37 Traefik versions 3.1.3 through 3.6.8 Description Traefik, an HTTP reverse proxy and load balancer, has an issue in how it manages the Connection header in conjunction with X-Forwarded headers. When...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: sops, harbor, pulumi, crossplane-provider-aws-eks, gitlab-runner, pulumi-language-yaml, emissary, mattermost, terraform-provider-acme, datadog-agent, grafana-mimir, opentelemetry-collector, kyverno-policy-reporter, crossplane-provider-aws-cloudwatchlogs, bento,...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: sops, harbor, pulumi, crossplane-provider-aws-eks, gitlab-runner, pulumi-language-yaml, emissary, mattermost, terraform-provider-acme, datadog-agent, grafana-mimir, opentelemetry-collector, kyverno-policy-reporter, crossplane-provider-aws-cloudwatchlogs, bento,...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ec2-fips, terraform-provider-acme-fips, rke2-runtime-fips, crossplane-provider-aws-servicediscovery, ksops, crossplane-provider-aws-kms, crossplane-provider-aws-s3, flux-kustomize-controller, aws-ebs-csi-driver,...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ec2-fips, terraform-provider-acme-fips, rke2-runtime-fips, crossplane-provider-aws-servicediscovery, ksops, crossplane-provider-aws-kms, crossplane-provider-aws-s3, flux-kustomize-controller, aws-ebs-csi-driver,...

GHSA-89P3-4642-CR2W vulnerabilities

Vulnerabilities for packages: traefik, traefik-fips...

CVE-2026-25949 vulnerabilities

Vulnerabilities for packages: traefik, traefik-fips...

GO-2026-4530 Traefik affected by TLS ClientAuth Bypass on HTTP/3 in github.com/traefik/traefik

Traefik affected by TLS ClientAuth Bypass on HTTP/3 in github.com/traefik/traefik...

Traefik affected by TLS ClientAuth Bypass on HTTP/3

Summary There is a potential vulnerability in Traefik managing HTTP/3 connections. More details in the CVE-2025-68121. Patches - https://github.com/traefik/traefik/releases/tag/v2.11.37 - https://github.com/traefik/traefik/releases/tag/v3.6.8 Workarounds No workaround For more information If you...

GHSA-GV8R-9RW9-9697 Traefik affected by TLS ClientAuth Bypass on HTTP/3

Summary There is a potential vulnerability in Traefik managing HTTP/3 connections. More details in the CVE-2025-68121. Patches - https://github.com/traefik/traefik/releases/tag/v2.11.37 - https://github.com/traefik/traefik/releases/tag/v3.6.8 Workarounds No workaround For more information If you...

traefik-3.6.8-1.1 on GA media (moderate)

traefik-3.6.8-1.1 on GA media Announcement ID: openSUSE-SU-2026:10217-1 Rating: moderate Cross-References: CVE-2026-25949 CVSS scores: CVE-2026-25949 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-25949 SUSE : 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N...

GO-2026-4484 Traefik: TCP readTimeout bypass via STARTTLS on Postgres in github.com/traefik/traefik

Traefik: TCP readTimeout bypass via STARTTLS on Postgres in github.com/traefik/traefik...

OPENSUSE-SU-2026:10217-1 traefik-3.6.8-1.1 on GA media

These are all security issues fixed in the traefik-3.6.8-1.1 package on the GA media of openSUSE Tumbleweed...

FreeBSD : traefik -- TCP readTimeout bypass via STARTTLS on Postgres (590979aa-09f7-11f1-a730-5404a68ad561)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 590979aa-09f7-11f1-a730-5404a68ad561 advisory. The traefik project reports: There is a potential vulnerability in Traefik managing STARTTLS requests. ...