Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GO-2026-6454
  • Go/github.com/traefik/traefik
  • Go/github.com/traefik/traefik/v2
  • Go/github.com/traefik/traefik/v3
 Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded in github.com/traefik/traefik 16 Sep
  • Fix available
GO-2026-6455
  • Go/github.com/traefik/traefik
  • Go/github.com/traefik/traefik/v2
  • Go/github.com/traefik/traefik/v3
 Traefik: ForwardAuth identity spoofing via dot-form header alias in github.com/traefik/traefik 16 Sep
  • Fix available
GO-2026-6465
  • Go/github.com/traefik/traefik
  • Go/github.com/traefik/traefik/v2
  • Go/github.com/traefik/traefik/v3
 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging in github.com/traefik/traefik 16 Sep
  • Fix available
GO-2026-6466
  • Go/github.com/traefik/traefik
  • Go/github.com/traefik/traefik/v2
  • Go/github.com/traefik/traefik/v3
 Traefik HTTP/3 Backend NTLM Connection Reuse in github.com/traefik/traefik 16 Sep
  • Fix available
GO-2026-6467
  • Go/github.com/traefik/traefik
  • Go/github.com/traefik/traefik/v2
  • Go/github.com/traefik/traefik/v3
 Traefik entrypoint header-name sanitization bypassed via request trailers in github.com/traefik/traefik 16 Sep
  • Fix available
GO-2026-6468
  • Go/github.com/traefik/traefik
  • Go/github.com/traefik/traefik/v2
  • Go/github.com/traefik/traefik/v3
 Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization in github.com/traefik/traefik 16 Sep
  • Fix available
GHSA-w4v4-9rw7-5326
  • Go/github.com/traefik/traefik/v2
  • Go/github.com/traefik/traefik/v3
 Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization 10 Sep
  • Fix available
  • Severity - 7.0 (High)
GHSA-qqjf-53cj-pwvv
  • Go/github.com/traefik/traefik/v2
  • Go/github.com/traefik/traefik/v3
 Traefik HTTP/3 Backend NTLM Connection Reuse 10 Sep
  • Fix available
  • Severity - 9.1 (Critical)
GHSA-f52w-8j3h-j724
  • Go/github.com/traefik/traefik/v2
  • Go/github.com/traefik/traefik/v3
 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging 10 Sep
  • Fix available
  • Severity - 8.8 (High)
GHSA-rf44-j88r-hh8c
  • Go/github.com/traefik/traefik/v2
  • Go/github.com/traefik/traefik/v3
 Traefik: ForwardAuth identity spoofing via dot-form header alias 10 Sep
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-7ghq-v6jf-g56c
  • Go/github.com/traefik/traefik/v2
  • Go/github.com/traefik/traefik/v3
 Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded 10 Sep
  • Fix available
  • Severity - 5.3 (Medium)
GO-2026-6192
  • Go/github.com/traefik/traefik
  • Go/github.com/traefik/traefik/v2
  • Go/github.com/traefik/traefik/v3
 Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass in github.com/traefik/traefik 18 Aug
  • Fix available
GO-2026-6201
  • Go/github.com/traefik/traefik
  • Go/github.com/traefik/traefik/v2
  • Go/github.com/traefik/traefik/v3
 Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool in github.com/traefik/traefik 18 Aug
  • Fix available
GO-2026-6202
  • Go/github.com/traefik/traefik
  • Go/github.com/traefik/traefik/v2
  • Go/github.com/traefik/traefik/v3
 Traefik: ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false in github.com/traefik/traefik 18 Aug
  • Fix available
GO-2026-6203
  • Go/github.com/traefik/traefik
  • Go/github.com/traefik/traefik/v2
  • Go/github.com/traefik/traefik/v3
 Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef in github.com/traefik/traefik 18 Aug
  • Fix available
GO-2026-6204
  • Go/github.com/traefik/traefik
  • Go/github.com/traefik/traefik/v2
  • Go/github.com/traefik/traefik/v3
 Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing in github.com/traefik/traefik 18 Aug
  • Fix available
Load more...