traefik -- ACME TLS-ALPN fast path potential DoS

The traefik project reports: There is a potential vulnerability in Traefik ACME TLS certificates' automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up goroutines and file descriptors indefinitely when the ACME TLS challenge is enabled.A malicious client ca...

PT-2026-3141

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.11.35 and 3.6.7 Description Traefik, an HTTP reverse proxy and load balancer, has a potential issue in its ACME TLS certificates' automatic generation. The ACME TLS-ALPN fast path can allow unauthenticated clients t...

The vulnerability of the Reverse Proxy Server of Containous Traefik arises from incorrect restrictions on the path name to the restricted catalog, allowing attackers to disclose protected information.

The vulnerability of the Containous Traefik reverse proxy server is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability can allow a malicious actor to disclose the protected information...

CVE-2022-23469

Traefik is an open source HTTP reverse proxy and load balancer. Versions prior to 2.9.6 are subject to a potential vulnerability in Traefik displaying the Authorization header in its debug logs. In certain cases, if the log level is set to DEBUG, credentials provided using the Authorization heade...

CVE-2019-20894

Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred...

CVE-2023-29013

Traefik pronounced traffic is a modern HTTP reverse proxy and load balancer for deploying microservices. There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik. HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This...

traefik-3.6.6-1.1 on GA media (moderate)

traefik-3.6.6-1.1 on GA media Announcement ID: openSUSE-SU-2026:10020-1 Rating: moderate Cross-References: CVE-2025-66490 CVE-2025-66491 CVSS scores: CVE-2025-66490 SUSE : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2025-66490 SUSE : 6.9...

OPENSUSE-SU-2026:10020-1 traefik-3.6.6-1.1 on GA media

These are all security issues fixed in the traefik-3.6.6-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2019-12452

types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control which is contrary to the API documentation, allows remote authenticated users to discover password hashes by reading the Basic HTT...

FreeBSD : traefik -- Bypassing security controls via special characters (91b9790e-de65-11f0-b893-5404a68ad561)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 91b9790e-de65-11f0-b893-5404a68ad561 advisory. The traefik project reports: There is a potential vulnerability in Traefik managing the requests using ...

FreeBSD : traefik -- Inverted TLS Verification Logic in Kubernetes NGINX Provider (dc7e30db-de67-11f0-b893-5404a68ad561)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the dc7e30db-de67-11f0-b893-5404a68ad561 advisory. The traefik project reports: There is a potential vulnerability in Traefik NGINX provider managing the...

GO-2025-4205 Traefik Inverted TLS Verification Logic in ingress-nginx Provider in github.com/traefik/traefik

Traefik Inverted TLS Verification Logic in ingress-nginx Provider in github.com/traefik/traefik...

GO-2025-4206 Path Normalization Bypass in Traefik Router + Middleware Rules in github.com/traefik/traefik

Path Normalization Bypass in Traefik Router + Middleware Rules in github.com/traefik/traefik...

CVE-2025-64702 vulnerabilities

Vulnerabilities for packages: q, seaweedfs, k8sgateway, syncthing-fips, ipfs-cluster, spegel-fips, traefik-fips, coredns-fips, kargo, coredns, caddy, k3s, eks-distro-fips, eks-distro, rke2-runtime, seaweedfs-fips, dkron, kubernetes-dns-node-cache, caddy-fips, traefik, dkron-fips, syncthing, spege...

GHSA-G754-HX8W-X2G6 vulnerabilities

Vulnerabilities for packages: q, seaweedfs, k8sgateway, syncthing-fips, ipfs-cluster, spegel-fips, traefik-fips, coredns-fips, kargo, coredns, caddy, k3s, eks-distro-fips, eks-distro, rke2-runtime, seaweedfs-fips, dkron, kubernetes-dns-node-cache, caddy-fips, traefik, dkron-fips, syncthing, spege...

SUSE CVE-2025-66490

Traefik is an HTTP reverse proxy and load balancer. For versions prior to 2.11.32 and 2.11.31 through 3.6.2, requests using PathPrefix, Path or PathRegex matchers can bypass path normalization. When Traefik uses path-based routing, requests containing URL-encoded restricted characters /, , Null,...

SUSE CVE-2025-66491

Traefik is an HTTP reverse proxy and load balancer. Versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to "on" intending to enable backend TLS certificate verification actually disables...

CVE-2025-66491

Traefik is an HTTP reverse proxy and load balancer. Versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to "on" intending to enable backend TLS certificate verification actually disables...

CVE-2025-66490

Traefik is an HTTP reverse proxy and load balancer. For versions prior to 2.11.32 and 2.11.31 through 3.6.2, requests using PathPrefix, Path or PathRegex matchers can bypass path normalization. When Traefik uses path-based routing, requests containing URL-encoded restricted characters /, , Null,...

CVE-2025-66491 Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider

Traefik is an HTTP reverse proxy and load balancer. Versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to "on" intending to enable backend TLS certificate verification actually disables...