https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T06:29:57.756339+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0236 certfr-2026-avi-0236 — De multiples vulnérabilités ont été découvertes dans Traefik. Elles permettent à un attaquant de provoquer un déni de s… 2026-10-04T06:29:57.839692+00:00 certfr-2026-avi-0236 https://cve.radiocsirt.org/vuln/cleanstart-2026-iz44500 CLEANSTART-2026-IZ44500 — Security fix for CVE-2026-26998 applied in: forecastle 1.0.159-r1 2026-10-04T06:29:57.839737+00:00

Affected: CleanStart: forecastle

Security vulnerability affects the forecastle package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-274806 EUVD-2026-274806 2026-10-04T06:29:57.839769+00:00 EUVD-2026-274806 https://cve.radiocsirt.org/vuln/fkie_cve-2026-26998 fkie_cve-2026-26998 2026-10-04T06:29:57.839783+00:00

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing the ForwardAuth middleware responses. When Traefik is configured to use the ForwardAuth middleware, the response body from the authentication server is read entirely into memory without any size limit. There is no maxResponseBodySize configuration to restrict the amount of data read from the authentication server response. If the authentication server returns an unexpectedly large or unbounded response body, Traefik will allocate unlimited memory, potentially causing an out-of-memory (OOM) condition that crashes the process. This results in a denial of service for all routes served by the affected Traefik instance. This issue has been patched in versions 2.11.38 and 3.6.9.

 https://cve.radiocsirt.org/vuln/ghsa-fw45-f5q2-2p4x GHSA-fw45-f5q2-2p4x — Traefik has unbounded io.ReadAll on auth server response body that causes OOM DOS 2026-10-04T06:29:57.839809+00:00

Affected: Go: github.com/traefik/traefik/v2, Go: github.com/traefik/traefik/v3

## Impact

There is a potential vulnerability in Traefik managing the ForwardAuth middleware responses.

When Traefik is configured to use the ForwardAuth middleware, the response body from the authentication server is read entirely into memory without any size limit. There is no `maxResponseBodySize` configuration to restrict the amount of data read from the authentication server response. If the authentication server returns an unexpectedly large or unbounded response body, Traefik will allocate unlimited memory, potentially causing an out-of-memory (OOM) condition that crashes the process.

This results in a denial of service for all routes served by the affected Traefik instance.

## Patches

- https://github.com/traefik/traefik/releases/tag/v2.11.38 - https://github.com/traefik/traefik/releases/tag/v3.6.9

## Workarounds

No workaround available.

## For more information

If there are any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

---

<details> <summary>Original Description</summary>

### Summary

The ForwardAuth middleware reads the entire authentication server response body into memory using io.ReadAll with no size limit. A single HTTP request through a ForwardAuth-protected route can cause the Traefik process to allocate gigabytes of memory and be killed by the OOM killer, resulting in complete denial of service for all routes on the affected entrypoint.

### Details

In pkg/middlewares/auth/forward…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10314-1 openSUSE-SU-2026:10314-1 — traefik2-2.11.40-1.1 on GA media 2026-10-04T06:29:57.839878+00:00

traefik2-2.11.40-1.1 on GA media