Traefik Reverse Proxy Vulnerability: Cross-User Response Poisoning
- Severity
- HIGH
- Affected component
- traefik (github-actions)
- Patched version
- v2.11.53, v3.6.24, v3.7.9
An early warning has been issued for a high-severity vulnerability in Traefik reverse proxy that could allow an unauthenticated attacker to poison responses across users.
What happened
An early warning has been issued for a critical vulnerability in Traefik reverse proxy. The vulnerability, tracked as GHSA-3CCP-42PG-HGV6, involves Traefik's default behavior of forwarding plain HTTP/2 or HTTP/3 CONNECT requests and their bodies to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream responds with a keep-alive non-2xx response and does not drain the body, Traefik returns the desynchronized backend socket to its shared pool and reuses it for other clients. An unauthenticated attacker can exploit this to make a different client read the attacker's smuggled response.
The vulnerability has not been exploited in the wild as of the latest reports. However, it is under investigation and users are advised to take immediate action to mitigate potential risks.
What to do about it
- Upgrade to Traefik v2.11.53, v3.6.24, or v3.7.9 to mitigate the vulnerability.
- Review your Traefik configurations to ensure that they are aligned with the recommended secure settings.
- Monitor your Traefik logs for any unusual activity that may indicate an attempt to exploit this vulnerability.
- Consult the primary sources for the latest updates and additional mitigation advice.
How 0Day would have caught this
traefik is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using Traefik, you should assume you are affected until you have upgraded to one of the patched versions: v2.11.53, v3.6.24, or v3.7.9.
What should I do right now?
Immediately upgrade to Traefik v2.11.53, v3.6.24, or v3.7.9. Review your configurations and monitor your logs for any suspicious activity.
Has this been exploited in the wild?
No, the vulnerability has not been reported as exploited in the wild as of the latest information.
Where can I find more information?
Consult the primary source at https://github.com/traefik/traefik/security/advisories/GHSA-3ccp-42pg-hgv6 for the latest details and updates.