Traefik 2.11.51 → 2.11.53
2 releases · 0 breaking changes · 2 security fixes · 2 advisories fixed
2security0breaking0deprecated1feature8fix
Vulnerabilities fixed by this upgrade
- 7.0 CVE-2026-71324 Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool
- 7.8 GHSA-cxjq-mrr5-89rv Authentication Bypass via Path Traversal in ReplacePathRegex Middleware
Breaking changes
None in the release notes.
Security changes
- security Advisory GHSA-3ccp-42pg-hgv6 in 2.11.53
- security Advisory GHSA-cxjq-mrr5-89rv in 2.11.52
Every release in between
securityAdvisory GHSA-3ccp-42pg-hgv6
fix[middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs ( @kevinpollet)
fix[server] Defer the CONNECT payload until the backend accepts the tunnel ( @sdelicata)
fix[server] Bump google.golang.org/grpc to v1.82.1 ( @piscue)
fix[server] Do not add back CONNECT requests to the pool ( @kevinpollet)
featureAdd a migration note for CONNECT requests ( @kevinpollet)
securityAdvisory GHSA-cxjq-mrr5-89rv
fix[middleware] Sanitize replaced path in ReplacePathRegex middleware ( @kevinpollet)
fix[acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 ( @rtribotte)
fix[otel] Bump go.opentelemetry.io/otel to v1.44.0 ( @rtribotte)
fixFix changelog v2.11.51 ( @mmatur)