Most recent entries from all

bdu:2024-07712

2026-10-06T13:16:21.834164+00:00

bdu:2024-07712

certfr-2024-avi-0812 — Une vulnérabilité a été découverte dans Traefik. Elle permet à un attaquant de provoquer un contournement de la politiq…

2026-10-06T13:16:21.834202+00:00

certfr-2024-avi-0812

EUVD-2026-186939

2026-10-06T13:16:21.834223+00:00

EUVD-2026-186939

fkie_cve-2024-45410

2026-10-06T13:16:21.834235+00:00

Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it should not be possible to remove or modify these headers. Since the application trusts the value of these headers, security implications might arise, if they can be modified. For HTTP/1.1, however, it was found that some of theses custom headers can indeed be removed and in certain cases manipulated. The attack relies on the HTTP/1.1 behavior, that headers can be defined as hop-by-hop via the HTTP Connection header. This issue has been addressed in release versions 2.11.9 and 3.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

GHSA-62c8-mh53-4cqv — HTTP client can manipulate custom HTTP headers that are added by Traefik

2026-10-06T13:16:21.834276+00:00

Affected: Go: github.com/traefik/traefik/v3, Go: github.com/traefik/traefik/v2, Go: github.com/traefik/traefik

### Impact

There is a vulnerability in Traefik that allows the client to remove the X-Forwarded headers (except the header X-Forwarded-For).

### Patches

- https://github.com/traefik/traefik/releases/tag/v2.11.9 - https://github.com/traefik/traefik/releases/tag/v3.1.3

### Workarounds

No workaround.

### For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

Original Description

### Summary

When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it should not be possible to remove or modify these headers. Since the application trusts the value of these headers, security implications might arise, if they can be modified.

For HTTP/1.1, however, it was found that some of theses custom headers can indeed be removed and in certain cases manipulated. The attack relies on the HTTP/1.1 behavior, that headers can be defined as hop-by-hop via the HTTP Connection header. By setting the following connection header, the X-Forwarded-Host header can, for example, be removed:

Connection: close, X-Forwarded-Host

Depending on how the receiving application handles such cases, security implications may arise. Moreover, some application frameworks (e.g. Django) first transform the "-" to "_" signs, making it possible for the H…

openSUSE-SU-2024:14365-1 — traefik-3.1.4-1.1 on GA media

2026-10-06T13:16:21.834353+00:00

traefik-3.1.4-1.1 on GA media

RHSA-2025:8244 — Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.21.0 release

2026-10-06T13:16:21.834372+00:00

tar-fs: link following and path traversal via maliciously crafted tar file golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto traefik: HTTP client can manipulate custom HTTP headers that are added by Traefik golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing