Hi everyone,
We have released new security updates for Traefik Proxy: 2.11.57 and 3.7.13.
These releases fix the following security advisories:
- [Critical] GHSA-qqjf-53cj-pwvv: HTTP/3 backend NTLM/Negotiate connection reuse: an HTTP/3 client could inherit another user's authenticated backend connection. Fixed in 2.11.57 and 3.7.13.
Traefik HTTP/3 Backend NTLM Connection Reuse · Advisory · traefik/traefik · GitHub - [High] GHSA-f52w-8j3h-j724: a rootless/opaque HTTP request-target could bypass routing, path-scoped authorization, and access logging. Fixed in 2.11.57 and 3.7.13.
Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging · Advisory · traefik/traefik · GitHub - [High] GHSA-w4v4-9rw7-5326: a client-initiated
Upgrade: h2ccould be tunneled to a backend that honors it, bypassing the middleware chain. Fixed in 2.11.57 and 3.7.13.
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization in github.com/traefik/traefik/v3 · Advisory · traefik/traefik · GitHub - [High] GHSA-v67p-phpq-fc8x: entrypoint header-name sanitization could be bypassed via request trailers. Fixed in 3.7.13 (Traefik v2 is not affected).
Traefik entrypoint header-name sanitization bypassed via request trailers · Advisory · traefik/traefik · GitHub - [Medium] GHSA-8fcf-v89g-xpg6: a timing oracle in BasicAuth could allow username enumeration under concurrency. Fixed in 3.7.13 (Traefik v2 is not affected).
BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle · Advisory · traefik/traefik · GitHub
Release notes:
We strongly recommend upgrading as soon as possible.
The Traefik team