CVE-2026-114641
- Source
- https://cve.org/CVERecord?id=CVE-2026-114641
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114641.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-114641
- Aliases
-
- GHSA-mhjw-hmjv-p99x
- Published
- 2026-10-22T01:43:40Z
- Modified
- 2026-10-22T10:45:53Z
- Severity
-
- 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper
- Details
-
Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send concurrent HTTP/2 or HTTP/3 requests over one connection to orphan backend connections, break connection-bound authentication, or crash Traefik.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-362" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114641.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114641.json
- https://github.com/traefik/traefik/security/advisories/GHSA-mhjw-hmjv-p99x
- https://nvd.nist.gov/vuln/detail/CVE-2026-114641
- https://www.vulncheck.com/advisories/traefik-before-2.11.58-and-3.7.14-race-condition-in-ntlm-kerberos-round-tripper
Affected packages
Git / github.com/traefik/traefik
Affected ranges
- Type
- GIT
- Repo
- https://github.com/traefik/traefik
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "2.11.0" }, { "fixed": "2.11.58" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "introduced": "3.0.0" }, { "fixed": "3.7.14" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] }
Affected versions
v2.*
v2.11.0
v2.11.1
v2.11.10
v2.11.11
v2.11.12
v2.11.13
v2.11.14
v2.11.15
v2.11.16
v2.11.17
v2.11.18
v2.11.19
v2.11.2
v2.11.20
v2.11.21
v2.11.22
v2.11.23
v2.11.24
v2.11.25
v2.11.26
v2.11.27
v2.11.28
v2.11.29
v2.11.3
v2.11.30
v2.11.31
v2.11.32
v2.11.33
v2.11.34
v2.11.35
v2.11.36
v2.11.37
v2.11.38
v2.11.39
v2.11.4
v2.11.40
v2.11.41
v2.11.42
v2.11.43
v2.11.44
v2.11.45
v2.11.46
v2.11.47
v2.11.48
v2.11.49
v2.11.5
v2.11.50
v2.11.51
v2.11.52
v2.11.53
v2.11.54
v2.11.55
v2.11.56
v2.11.57
v2.11.6
v2.11.7
v2.11.8
v2.11.9