felhom.eu/documentation/audits/security-watch-2026-10-26/raw/repoadv-traefik_traefik.txt

GHSA-hrpp-p4fc-wwf8 2026-10-21 high | ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity  | go:github.com/traefik/traefik/v2 | <= v2.11.59 -> v2.11.60 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.15 -> v3.7.16
GHSA-p8wx-ph99-xgcr 2026-10-16 high | ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another I | go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.14 -> v3.7.15
GHSA-fh26-gfpp-7xxx 2026-10-07 high | snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`) | go:github.com/traefik/traefik/v2 | <= v2.11.57 -> v2.11.58 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.13 -> v3.7.14
GHSA-qvj7-gq9c-hp7q 2026-10-07 high | Kubernetes Ingress NGINX provider: ssl-passthrough sibling HTTP router serves the auth-pro | go:github.com/traefik/traefik/v3 | >= v3.7.13, <= v3.7.13 -> v3.7.14
GHSA-53qr-784g-cj35 2026-10-07 high | FastProxy backend connection pool leaks connection-bound NTLM/Negotiate identity to unauth | go:github.com/traefik/traefik/v3 | >= v3.2.0, <= v3.7.13 -> v3.7.14
GHSA-rv2h-qh7j-xrjw 2026-10-07 high | Ingress-NGINX provider: colliding auth-tls-secret names merge two client CAs into one TLS  | go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.13 -> v3.7.14
GHSA-qm9f-w54v-q2qh 2026-10-07 high | Preauthenticated Negotiate contaminates Traefik's globally shared backend connection pool | go:github.com/traefik/traefik/v2 | >= v2.11.0, <= v2.11.57 -> v2.11.58 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.13 -> v3.7.14
GHSA-mwrr-6hp4-pxr6 2026-10-07 high | Ingress-NGINX provider forwards forged Ssl-Client-* identity headers on its HTTP route | go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.13 -> v3.7.14
GHSA-28hp-c82p-8vqj 2026-10-16 low | Kubernetes Ingress NGINX provider: a TLS-option cache hit skips the cross-namespace author | go:github.com/traefik/traefik/v3 | >= v3.7.11, <= v3.7.14 -> v3.7.15
GHSA-v67p-phpq-fc8x 2026-09-07 high | Traefik entrypoint header-name sanitization bypassed via request trailers | go:github.com/traefik/traefik/v3 | >= v3.2.0, <= v3.7.12 -> v3.7.13
GHSA-qqjf-53cj-pwvv 2026-09-07 critical | Traefik HTTP/3 Backend NTLM Connection Reuse | go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.12 -> v3.7.13 ; go:github.com/traefik/traefik/v2 | >= v2.11.0, <= v2.11.56 -> v2.11.57
GHSA-ww7c-q3mv-xx22 2026-10-16 high | Data race on the shared bufio.Reader after an HTTP/1 upgrade in FastProxy panics the whole | go:github.com/traefik/traefik/v3 | >= v3.2.0, <= v3.7.14 -> v3.7.15
GHSA-mhjw-hmjv-p99x 2026-10-07 medium | Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/ | go:github.com/traefik/traefik/v2 | >= v2.11.0, <= v2.11.57 -> v2.11.58 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.13 -> v3.7.14
GHSA-cw35-4q88-3rmp 2026-10-07 high | Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one | go:github.com/traefik/traefik/v2 | >= v2.11.0, <= v2.11.57 -> v2.11.58 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.13 -> v3.7.14
GHSA-2272-4vv8-65ww 2026-10-07 medium | Negated Host matcher causes a TLS option conflict that disables client-certificate authent | go:github.com/traefik/traefik/v2 | <= v2.11.57 -> v2.11.58 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.12 -> v3.7.13
GHSA-8fcf-v89g-xpg6 2026-09-07 medium | BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration tim | go:github.com/traefik/traefik/v3 | >= v3.6.11, <= v3.7.12 -> v3.7.13
GHSA-f52w-8j3h-j724 2026-09-07 high | Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-sco | go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.12 -> v3.7.13 ; go:github.com/traefik/traefik/v2 | <= v2.11.56 -> v2.11.57
GHSA-w4v4-9rw7-5326 2026-09-07 high | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incor | go:github.com/traefik/traefik/v3 | >= v3.4.2, <= v3.7.12 -> v3.7.13 ; go:github.com/traefik/traefik/v2 | >= v2.11.26, <= v2.11.56 -> v2.11.57
GHSA-cjr6-pf59-jq29 2026-08-27 high | ingress-nginx from-to-www-redirect sibling router serves the auth-protected backend withou | go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.11 -> v3.7.12
GHSA-7ghq-v6jf-g56c 2026-08-27 medium | respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbound | go:github.com/traefik/traefik/v2 | >= v2.8.2, <= v2.11.55 -> v2.11.56 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.11 -> v3.7.12
GHSA-m6wx-622r-48r9 2026-08-21 high | Kubernetes Ingress service middleware bypasses crossProviderNamespaces | go:github.com/traefik/traefik/v3 | >= v3.7.1, <= v3.7.10 -> v3.7.11
GHSA-rf44-j88r-hh8c 2026-08-27 medium | ForwardAuth identity spoofing via dot-form header alias | go:github.com/traefik/traefik/v2 | <= v2.11.55 -> v2.11.56 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.11 -> v3.7.12
GHSA-5w68-77r2-r64c 2026-08-21 critical | Complete authentication bypass in the `digestAuth` middleware | go:github.com/traefik/traefik/v2 | <= v2.11.54 -> v2.11.55 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.10 -> v3.7.11
GHSA-j994-9gqj-9hwq 2026-08-21 high | Same-host Ingress TLS option conflict disables client-certificate authentication | go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.10 -> v3.7.11
GHSA-g55h-rg46-x9c5 2026-08-21 high | TLS option confusion in multi-host routers can bypass mTLS for protected hosts | go:github.com/traefik/traefik/v2 | <= v2.11.54 -> v2.11.55 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.10 -> v3.7.11
GHSA-fgjj-px3w-67xx 2026-08-03 high | Gateway API route identity collision allows cross-namespace backend hijacking | go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.24 -> v3.6.25 ; go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.9 -> v3.7.10
GHSA-6765-c87h-8mrf 2026-08-03 low | BasicAuth singleflight key collision allows authenticated identity spoofing | go:github.com/traefik/traefik/v3 | >= v3.6.11, <= v3.6.24 -> v3.6.25 ; go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.9 -> v3.7.10
GHSA-62fc-8686-hfmq 2026-08-03 medium | `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef | go:github.com/traefik/traefik/v2 | <= v2.11.53 -> v2.11.54 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.24 -> v3.6.25 ; go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.9 -> v3.7.10
GHSA-3ccp-42pg-hgv6 2026-07-27 high | Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive p | go:github.com/traefik/traefik/v2 | <= v2.11.52 -> v2.11.53 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.23 -> v3.6.24 ; go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.8 -> v3.7.9
GHSA-8rxv-jg7p-wvg3 2026-07-16 high | Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication By | go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.7 -> v3.7.8
GHSA-cxjq-mrr5-89rv 2026-07-09 high | Authentication Bypass via Path Traversal in ReplacePathRegex Middleware | go:github.com/traefik/traefik | <= v1.7.34 ->  ; go:github.com/traefik/traefik/v2 | <= v2.11.51 -> v2.11.52 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.22 -> v3.6.23 ; go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.6 -> v3.7.7
GHSA-qq9q-x9w4-chhj 2026-07-09 medium | Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion | go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.6 -> v3.7.7
GHSA-42cj-m3vj-89wv 2026-07-09 medium | Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass | go:github.com/traefik/traefik/v3 | >= v3.6.17, <= v3.6.22 -> v3.6.23 ; go:github.com/traefik/traefik/v3 | >= v3.7.1, <= v3.7.6 -> v3.7.7
GHSA-6p8f-p8j2-rqmv 2026-07-01 medium | Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Serv | go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.5 -> v3.7.6
GHSA-3g6v-2r68-prfc 2026-06-11 medium | Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist t | go:github.com/traefik/traefik/v3 | >= v3.6.17, <= v3.6.20 -> v3.6.21 ; go:github.com/traefik/traefik/v3 | >= v3.7.1, <= v3.7.4 -> v3.7.5
GHSA-4mr2-fg2p-w63c 2026-06-19 medium | Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails | go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.4 -> v3.7.5
GHSA-3q9r-p662-5j8m 2026-07-01 medium | ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto whe | go:github.com/traefik/traefik | <= v1.7.34 ->  ; go:github.com/traefik/traefik/v2 | <= v2.11.50 -> v2.11.51 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.21 -> v3.6.22 ; go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.5 -> v3.7.6
GHSA-x677-9fxg-v5c5 2026-07-01 high | Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-va | go:github.com/traefik/traefik/v2 | <= v2.11.50 -> v2.11.51 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.21 -> v3.6.22 ; go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.5 -> v3.7.6
GHSA-xf64-8mw2-4gr2 2026-06-05 high | Traefik StripPrefix Route-Level Auth Bypass via Path Normalization | go:github.com/traefik/traefik/v2 | <= v2.11.46 -> v2.11.48 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.17 -> v3.6.19 ; go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.1 -> v3.7.3
GHSA-5r4w-85f3-pw66 2026-06-05 high | SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass | go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.1 -> v3.7.3
GHSA-9cr8-q42q-g8m7 2026-06-05 high | HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts | go:github.com/traefik/traefik/v2 | >= v2.5.0-rc1, <= v2.11.46 -> v2.11.48 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.17 -> v3.6.19 ; go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.1 -> v3.7.3
GHSA-96qj-4jj5-wcjc 2026-05-11 medium | Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure o | go:github.com/traefik/traefik/v2 | <= v2.11.45 -> v2.11.46 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.16 -> v3.6.17 ; go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.0 -> v3.7.1
GHSA-xhjw-95fp-8vgq 2026-04-24 medium | Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding | go:github.com/traefik/traefik/v2 | <= v2.11.42 -> v2.11.43 ; go:github.com/traefik/traefik/v3 | <= v3.6.13 -> v3.6.14 ; go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.0-rc.1 -> v3.7.0-rc.2
GHSA-p6hg-qh38-555r 2026-05-04 medium | Errors middleware forwards Authorization and Cookie headers to separate error page service | go:github.com/traefik/traefik/v2 | <= v2.11.43 -> v2.11.44 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.14 -> v3.6.15 ; go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.0-rc.2 -> v3.7.0-rc.3
GHSA-6x2q-h3cr-8j2h 2026-04-24 medium | BasicAuth middleware: timing side-channel vulnerability | go:github.com/traefik/traefik/v2 | <= v2.11.42 -> v2.11.43 ; go:github.com/traefik/traefik/v3 | <= v3.6.13 -> v3.6.14 ; go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.0-rc.1 -> v3.7.0-rc.2
GHSA-5m6w-wvh7-57vm 2026-04-24 high | Forwarded alias spoofing top pre-auth decision bypass | go:github.com/traefik/traefik | <= v1.7.34 ->  ; go:github.com/traefik/traefik/v2 | <= v2.11.42 -> v2.11.43 ; go:github.com/traefik/traefik/v3 | <= v3.6.13 -> v3.6.14 ; go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.0-rc.1 -> v3.7.0-rc.2
GHSA-6384-m2mw-rf54 2026-04-24 high | ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth | go:github.com/traefik/traefik | <= v1.7.34 ->  ; go:github.com/traefik/traefik/v2 | <= v2.11.42 -> v2.11.43 ; go:github.com/traefik/traefik/v3 | <= v3.6.13 -> v3.6.14 ; go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.0-rc.1 -> v3.7.0-rc.2
GHSA-6jwx-7vp4-9847 2026-04-24 high | StripPrefixRegex auth bypass via Path/RawPath desync | go:github.com/traefik/traefik | <= v1.7.34 ->  ; go:github.com/traefik/traefik/v2 | <= v2.11.42 -> v2.11.43 ; go:github.com/traefik/traefik/v3 | <= v3.6.13 -> v3.6.14 ; go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.0-rc.1 -> v3.7.0-rc.2
GHSA-46wh-3698-f2cx 2026-03-27 high | Fix CVE-2026-33186 | go:github.com/traefik/traefik/v2 | <= v2.11.41 -> v2.11.42 ; go:github.com/traefik/traefik/v3 | <= v3.6.11 -> v3.6.12 ; go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.0-ea.2 -> v3.7.0-ea.3
GHSA-qr99-7898-vr7c 2026-03-27 medium | BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField | go:github.com/traefik/traefik | <= v1.7.34 ->  ; go:github.com/traefik/traefik/v2 | <= v2.11.41 -> v2.11.42 ; go:github.com/traefik/traefik/v3 | <= v3.6.11 -> v3.6.12 ; go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.0-ea.2 -> v3.7.0-ea.3
GHSA-67jx-r9pv-98rj 2026-03-27 medium | Ingress Rule Injection Allows Host Restriction Bypass in Traefik | go:github.com/traefik/traefik/v3 | <= v3.6.10 -> v3.6.11 ; go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.0-ea.1 -> v3.7.0-ea.2
GHSA-wvvq-wgcr-9q48 2026-03-20 high | Potential mTLS Bypass via Fragmented TLS ClientHello Causing Pre-SNI Sniff Fallback to Def | go:github.com/traefik/traefik/v2 | <= v2.11.40 -> v2.11.41 ; go:github.com/traefik/traefik/v3 | <= v3.6.10 -> v3.6.11 ; go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.0-ea.1 -> v3.7.0-ea.2
GHSA-g3hg-j4jv-cwfr 2026-03-20 medium | BasicAuth Middleware Timing Attack Allows Username Enumeration | go:github.com/traefik/traefik | <= v1.7.34 ->  ; go:github.com/traefik/traefik/v2 | <= v2.11.40 -> v2.11.41 ; go:github.com/traefik/traefik/v3 | <= v3.6.10 -> v3.6.11 ; go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.0-ea.1 -> v3.7.0-ea.2
GHSA-4hjq-9h5c-252j 2026-03-11 high | HTTP/2 frames can cause a running server to panic | go:github.com/traefik/traefik/v2 | <= v2.11.39 -> v2.11.40 ; go:github.com/traefik/traefik/v3 | <= v3.6.9 -> v3.6.10
GHSA-8q2w-wr49-whqj 2026-03-11 medium | Kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values | go:github.com/traefik/traefik/v2 | >= v2.5.0-rc3, <= v2.11.54 -> v2.11.55 ; go:github.com/traefik/traefik/v3 | <= v3.6.9 -> v3.6.10
GHSA-fw45-f5q2-2p4x 2026-03-04 medium | ForwardAuth Middleware Allows Unbounded Response Body, Causing Potential Denial of Service | go:github.com/traefik/traefik/v2 | <= v2.11.37 -> v2.11.38 ; go:github.com/traefik/traefik/v3 | <= v3.6.8 -> v3.6.9
GHSA-xw98-5q62-jx94 2026-03-04 high | TLS Handshake Error Handling Allows Stalled Connections on TCP Routers | go:github.com/traefik/traefik/v2 | <= v2.11.37 -> v2.11.38 ; go:github.com/traefik/traefik/v3 | <= v3.6.8  -> v3.6.9
GHSA-92mv-8f8w-wq52 2026-03-04 high | Case-Sensitive Bypass in Connection Header Allows Removal of X-Forwarded Headers | go:github.com/traefik/traefik/v2 | >= v2.11.9, <= v2.11.37 -> v2.11.38 ; go:github.com/traefik/traefik/v3 | >= v3.1.3, <= v3.6.8 -> v3.6.9
GHSA-89p3-4642-cr2w 2026-02-12 high | TCP readTimeout bypass via STARTTLS on Postgres | go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.7 -> v3.6.8
GHSA-gv8r-9rw9-9697 2026-02-20 high | TLS ClientAuth Bypass on HTTP/3 | go:github.com/traefik/traefik/v2 | <= v2.11.36 -> v2.11.37 ; go:github.com/traefik/traefik/v3 | <= v3.6.7 -> v3.6.8
GHSA-cwjm-3f7h-9hwq 2026-01-15 medium | ACME TLS-ALPN fast path lacks timeouts and close on handshake stall | go:github.com/traefik/traefik/v2 | <= v2.11.34 -> v2.11.35 ; go:github.com/traefik/traefik/v3 | <= v3.6.6 -> v3.6.7
GHSA-rh7m-2m44-x32f 2026-10-05 medium | Traefik: Kubernetes Ingress and Service annotations allow cross-namespace references to Mi | go:github.com/traefik/traefik/v2 | <= v2.11.45 -> v2.11.46 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.16 -> v3.6.17 ; go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.0 -> v3.7.1
GHSA-7vww-mvcr-x6vj 2025-12-08 medium |  Inverted TLS Verification Logic in Kubernetes NGINX Provider | go:github.com/traefik/traefik/v3 | >= v3.5.0, <= v3.6.2 -> v3.6.3
GHSA-gm3x-23wp-hc2c 2025-12-08 high | Path Normalization Bypass in Traefik Router + Middleware Rules | go:github.com/traefik/traefik | <= v1.7.34 ->  ; go:github.com/traefik/traefik/v2 | <= v2.11.31 -> v2.11.32 ; go:github.com/traefik/traefik/v3 | <= v3.6.2 -> v3.6.3
GHSA-q6gg-9f92-r9wg 2025-08-01 high | Path Traversal in WASM Client Plugin | go:github.com/traefik/traefik/v2 | <= v2.11.27 -> v2.11.28 ; go:github.com/traefik/traefik/v3 | <= v3.4.4 -> v3.4.5 ; go:github.com/traefik/traefik/v3 | >= v3.5.0-rc1, <= v3.5.0-rc2 -> v3.5.0
GHSA-vrch-868g-9jx5 2025-05-28 low | Path traversal still possible using url encoding | go:github.com/traefik/traefik | <= v1.7.34 ->  ; go:github.com/traefik/traefik/v2 | <= v2.11.24 -> v2.11.25 ; go:github.com/traefik/traefik/v3 | <= v3.4.0 -> v3.4.1
GHSA-5423-jcjm-2gpv 2025-04-18 critical | Security Vulnerability: Go 1.23.x < 1.23.8 - HTTP Request Smuggling Vulnerability - 1.23.8 | go:The Go Programming Language | < 1.23.8 -> 1.23.8
GHSA-3wqc-mwfx-672p 2025-04-18 high | Fix CVE-2025-22868 | go:golang.org/x/oauth2/jws | < v0.27.0 -> v0.27.0
GHSA-6p68-w45g-48j7 2025-04-21 high | Path Matchers Vulnerability | go:github.com/traefik/traefik | <= v1.7.34 ->  ; go:github.com/traefik/traefik/v2 | <= v2.11.22 -> v2.11.23 ; go:github.com/traefik/traefik/v3 | <= v3.3.5 -> v3.3.6 ; go:github.com/traefik/traefik/v3 | >= v3.4.0-rc1, <= v3.4.0-rc1 -> v3.4.0-rc2
GHSA-hxr6-2p24-hf98 2024-12-17 medium | Fix CVE-2024-53259 | go:github.com/traefik/traefik/v2 | <= v2.11.14 -> v2.11.15 ; go:github.com/traefik/traefik/v3 | <= v3.2.1 -> v3.2.2
GHSA-h924-8g65-j9wg 2024-11-29 low | X-Forwarded-Prefix Header allows for Open Redirect | go:github.com/traefik/traefik | <= v1.7.34 ->  ; go:github.com/traefik/traefik/v2 | <= v2.11.13 -> v2.11.14 ; go:github.com/traefik/traefik/v3 | <= v3.2.0 -> v3.2.1
GHSA-62c8-mh53-4cqv 2024-09-19 critical | HTTP client can remove the X-Forwarded headers | go:github.com/traefik/traefik | <= v1.7.34 ->  ; go:github.com/traefik/traefik/v2 | <= v2.11.8 -> v2.11.9 ; go:github.com/traefik/traefik/v3 | <= v3.1.2 -> v3.1.3
GHSA-gxrv-wf35-62w9 2024-07-04 high | Bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes | go:github.com/traefik/traefik/v2 | <= v2.11.5 -> v2.11.6 ; go:github.com/traefik/traefik/v3 | <= v3.0.3 -> v3.0.4 ; go:github.com/traefik/traefik/v3 | >= v3.1.0-rc1, <= v3.1.0-rc2 -> v3.1.0-rc3
GHSA-rvj4-q8q5-8grf 2024-06-20 medium | ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability | go:github.com/traefik/traefik/v2 | <= v2.11.4 -> v2.11.5 ; go:github.com/traefik/traefik/v3 | <= v3.0.2 -> v3.0.3
GHSA-7jmw-8259-q9jx 2024-06-11 medium | Unexpected behavior with IPv4-mapped IPv6 addresses | go:github.com/traefik/traefik/v2 | <= v2.11.3 -> v2.11.4 ; go:github.com/traefik/traefik/v3 | <= v3.0.1 -> v3.0.2
GHSA-f7cq-5v43-8pwp 2024-05-23 medium | Malformed DNS message can cause infinite loop | go:github.com/traefik/traefik/v2 | <= v2.11.2 -> v2.11.3 ; go:github.com/traefik/traefik/v3 | <= v3.0.0 -> v3.0.1
GHSA-7f4j-64p6-5h5v 2024-04-15 medium | Fix CVE-2023-45288 - HTTP/2 CONTINUATION flood in net/http | go:github.com/traefik/traefik | <= v1.7.34 ->  ; go:github.com/traefik/traefik/v2 | <= v2.11.1 -> v2.11.2 ; go:github.com/traefik/traefik/v3 | <= v3.0.0-rc4 -> v3.0.0-rc5
GHSA-4vwx-54mw-vqfw 2024-04-12 high | Possible DoS vulnerability with Content-length header | go:github.com/traefik/traefik | <= v1.7.34 ->  ; go:github.com/traefik/traefik/v2 | <= v2.11.0 -> v2.11.2 ; go:github.com/traefik/traefik/v3 | <= v3.0.0-rc3 -> v3.0.0-rc5
GHSA-8g85-whqh-cr2f 2023-12-04 medium | Potential DDoS whith ACME HTTPChallenge | go:github.com/traefik/traefik | <= v1.7.34 ->  ; go:github.com/traefik/traefik/v2 | <= v2.10.5 -> v2.10.6 ; go:github.com/traefik/traefik/v3 | <= v3.0.0-beta4 -> v3.0.0-beta5
GHSA-6fwg-jrfw-ff7p 2023-12-04 medium | Uses 100% CPU after request to with host `traefik-service` | go:github.com/traefik/traefik/v2 | <= v2.10.5 -> v2.10.6 ; go:github.com/traefik/traefik/v3 | <= v3.0.0-beta4 -> v3.0.0-beta5
GHSA-fvhj-4qfh-q2hm 2023-12-04 low | Incorrect processing of fragment in the URL leads to Authorization Bypass | go:github.com/traefik/traefik | <= v1.7.34 ->  ; go:github.com/traefik/traefik/v2 | <= v2.10.5 -> v2.10.6 ; go:github.com/traefik/traefik/v3 | <= v3.0.0-beta4 -> v3.0.0-beta5
GHSA-7v4p-328v-8v5g 2023-10-12 medium | HTTP/2 request  could cause a deny of service  | go:Go | <=1.21.2, <=1.20.9 -> 1.21.3, 1.20.10 ; go:github.com/traefik/traefik/v2 | <= v2.10.4 -> v2.10.5 ; go:github.com/traefik/traefik/v3 | <= v3.0.0-beta3 -> v3.0.0-beta4
GHSA-7hj9-rv74-5g92 2023-04-11 high | HTTP header parsing could cause a deny of service  | go:github.com/traefik/traefik | <= v1.7.34 ->  ; go:Go | 1.20.2 -> 1.20.3 ; go:github.com/traefik/traefik/v2 | <= v2.9.9 -> v2.9.10 ; go:github.com/traefik/traefik/v2 | >= v2.10.0-rc1, <= v2.10.0-rc1 -> v2.10.0-rc2
GHSA-h2ph-vhm7-g4hp 2022-12-08 medium | Authorization header displayed in the debug logs | go:github.com/traefik/traefik/v2 | < 2.9.6 -> 2.9.6
GHSA-468w-8x39-gj5v 2022-12-08 high | Routes exposed with an empty TLSOption | go:github.com/traefik/traefik/v2 | < 2.9.6 -> 2.9.6
GHSA-c6hx-pjc3-7fqr 2022-10-10 high | HTTP/2 connections management could cause a deny of service | go:github.com/traefik/traefik | <= v1.7.34 ->  ; go:github.com/traefik/traefik/v2 | < v2.8.8 -> v2.8.8 ; go:github.com/traefik/traefik/v2 | >= v2.9.0-rc1, < v2.9.0-rc5 -> v2.9.0-rc5
GHSA-hrhx-6h34-j5hc 2022-02-16 high | Wrong TLS configuration choice | go:github.com/traefik/traefik/v2 | <2.6.1 -> 2.6.1
GHSA-m697-4v8f-55qg 2021-08-03 low | Drop Headers via Malicious Connection Header  | go:github.com/traefik/traefik/v2 | < v2.4.13 -> v2.4.13 ; go:github.com/traefik/traefik | <= v1.7.30 -> 
GHSA-6qq8-5wq3-86rp 2020-07-30 low | X-Forwarded-Prefix Header Validation Vulnerability | go:github.com/traefik/traefik/v2 | < v2.2.8 -> v2.2.8 ; go:github.com/traefik/traefik/v2 | >= v2.3.0-rc1, < v2.3.0-rc3 -> v2.3.0-rc3 ; go:github.com/traefik/traefik | < v1.7.26 -> v1.7.26