CVE-2026-88004

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-88004
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88004.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-88004
Aliases
Published
2026-09-10T14:33:41Z
Modified
2026-09-11T03:48:23Z
Severity
  • 7.0 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N CVSS Calculator
Summary
Traefik entrypoint header-name sanitization bypassed via request trailers
Details

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an unauthenticated client to submit an aliasing or trusted header name in an HTTP/1.1 chunked trailer or an HTTP/2 trailer. When the retry or buffering middleware reads the body before the reverse proxy clones the request, the attacker-controlled trailer value reaches a backend that merges trailers into the header namespace, bypassing the documented delete or reject behavior and potentially spoofing identity or forwarded routing data. This issue is fixed in 3.7.13.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-436",
        "CWE-807"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88004.json"
}
References

Affected packages

Git / github.com/traefik/traefik

Affected ranges

Type
GIT
Repo
https://github.com/traefik/traefik
Events
Introduced
25caa72c0972fcb829276ebf5a41ef0263fa4a6f
Fixed
fc92cc118a0557a029c7019d5ee06665127b0f13
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "3.2.0"
        },
        {
            "fixed": "3.7.13"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88004.json"