CVE-2025-66490

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-66490
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66490.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-66490
Aliases
Downstream
Related
Published
2025-12-09T00:35:26.530Z
Modified
2026-03-23T05:11:41.642427613Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules
Details

Traefik is an HTTP reverse proxy and load balancer. For versions prior to 2.11.32 and 2.11.31 through 3.6.2, requests using PathPrefix, Path or PathRegex matchers can bypass path normalization. When Traefik uses path-based routing, requests containing URL-encoded restricted characters (/, \, Null, ;, ?, #) can bypass the middleware chain and reach unintended backends. For example, a request to http://mydomain.example.com/admin%2F could reach service-a without triggering my-security-middleware, bypassing security controls for the /admin/ path. This issue is fixed in versions 2.11.32 and 3.6.3.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66490.json",
    "cwe_ids": [
        "CWE-436"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/traefik/traefik

Affected ranges

Type
GIT
Repo
https://github.com/traefik/traefik
Events
Introduced
d99d2f95e66a28ee8180634dc80fdf13ba68c62a
Fixed
4e441f8b183f60a3f5d82efbca18a7407318aeda

Affected versions

v2.*
v2.11.10
v2.11.11
v2.11.12
v2.11.13
v2.11.14
v2.11.15
v2.11.16
v2.11.17
v2.11.18
v2.11.19
v2.11.20
v2.11.21
v2.11.22
v2.11.23
v2.11.24
v2.11.25
v2.11.26
v2.11.27
v2.11.28
v2.11.29
v2.11.3
v2.11.30
v2.11.31
v2.11.32
v2.11.4
v2.11.5
v2.11.6
v2.11.7
v2.11.8
v2.11.9
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.1.0
v3.1.0-rc1
v3.1.0-rc2
v3.1.0-rc3
v3.1.1
v3.1.2
v3.1.3
v3.1.4
v3.1.5
v3.1.6
v3.1.7
v3.2.0
v3.2.0-rc1
v3.2.0-rc2
v3.2.1
v3.2.2
v3.2.3
v3.2.4
v3.2.5
v3.3.0
v3.3.0-rc1
v3.3.0-rc2
v3.3.1
v3.3.2
v3.3.3
v3.3.4
v3.3.5
v3.3.6
v3.3.7
v3.4.0
v3.4.0-rc1
v3.4.0-rc2
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v3.4.5
v3.5.0
v3.5.0-rc1
v3.5.0-rc2
v3.5.1
v3.5.2
v3.5.3
v3.5.4
v3.5.6
v3.6.0
v3.6.0-rc1
v3.6.1
v3.6.2
v3.6.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66490.json"