HTTP Reverse Proxy Vulnerability in Traefik by Traefik Labs
CVE-2026-71324
7HIGH
What is CVE-2026-71324?
Traefik, the open-source HTTP reverse proxy and load balancer, has a vulnerability that allows unauthenticated attackers to exploit the handling of HTTP/2 or HTTP/3 CONNECT requests. If an upstream server responds with a non-2xx status and fails to properly manage the request body, Traefik can mistakenly reuse a compromised socket for different clients. This situation can lead to an attacker being able to inject deceitful responses, potentially revealing sensitive information from previous client requests. The issue has been rectified in versions 2.11.53, 3.6.24, and 3.7.9.
Affected Version(s)
traefik < 2.11.53 < 2.11.53
traefik >= 3.0.0, < 3.6.24 < 3.0.0, 3.6.24
traefik >= 3.7.0, < 3.7.9 < 3.7.0, 3.7.9