GO-2026-5287

The HTTP/3 (QUIC) path performed a direct, case-sensitive lookup on the SNI value to select the applicable TLS configuration. This lookup failed to match wildcard host patterns (e.g., "*.example.com") or case variants of configured hostnames. In these cases, Traefik would fall back to the default TLS configuration, which might not enforce mutual TLS (mTLS), allowing unauthenticated clients to access protected backends.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-5287"
}

References

Affected packages

Go / github.com/traefik/traefik

Package

Name: github.com/traefik/traefik; View open source insights on deps.dev
Purl: pkg:golang/github.com/traefik/traefik

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5287.json"

Go / github.com/traefik/traefik/v2

Package

Name: github.com/traefik/traefik/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/traefik/traefik/v2

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.11.51

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/traefik/traefik/v2/pkg/server/router/tcp",
            "symbols": [
                "Router.GetTLSGetClientInfo",
                "Router.HTTP3TLSConfigMatcherFunc"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5287.json"

Go / github.com/traefik/traefik/v3

Package

Name: github.com/traefik/traefik/v3; View open source insights on deps.dev
Purl: pkg:golang/github.com/traefik/traefik/v3

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.7.3

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/traefik/traefik/v3/pkg/server/router/tcp",
            "symbols": [
                "Router.GetTLSGetClientInfo",
                "Router.HTTP3TLSConfigMatcherFunc"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5287.json"