Traefik 2.11.51 → 2.11.59
8 releases · 0 breaking changes · 15 security fixes · 15 advisories fixed
15security0breaking0deprecated1feature38fix
Vulnerabilities fixed by this upgrade
- 6.3 GHSA-mhjw-hmjv-p99x Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/2 streams
- 6.9 GHSA-2272-4vv8-65ww Negated Host matcher causes a TLS option conflict that disables client-certificate authentication on the excluded host
- 7.0 GHSA-cw35-4q88-3rmp Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one service TLS client config to another
- 7.0 GHSA-qm9f-w54v-q2qh Preauthenticated Negotiate contaminates Traefik's globally shared backend connection pool
- 7.0 GHSA-fh26-gfpp-7xxx snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`)
- 7.0 CVE-2026-88008 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization in github.com/traefik/traefik/v3
- 9.1 CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse
- 8.8 CVE-2026-88009 Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
- 5.3 CVE-2026-88012 respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded
- 5.3 CVE-2026-88011 ForwardAuth identity spoofing via dot-form header alias
- 8.2 GHSA-g55h-rg46-x9c5 TLS option confusion in multi-host routers can bypass mTLS for protected hosts
- 9.3 GHSA-5w68-77r2-r64c Complete authentication bypass in the `digestAuth` middleware
- 4.8 CVE-2026-71325 `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef
- 7.0 CVE-2026-71324 Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool
- 7.8 GHSA-cxjq-mrr5-89rv Authentication Bypass via Path Traversal in ReplacePathRegex Middleware
Breaking changes
None in the release notes.
Security changes
- security Advisory GHSA-cw35-4q88-3rmp in 2.11.58
- security Advisory GHSA-fh26-gfpp-7xxx in 2.11.58
- security Advisory GHSA-qm9f-w54v-q2qh in 2.11.58
- security Advisory GHSA-2272-4vv8-65ww in 2.11.58
- security Advisory GHSA-mhjw-hmjv-p99x in 2.11.58
- security Advisory GHSA-qqjf-53cj-pwvv in 2.11.57
- security Advisory GHSA-f52w-8j3h-j724 in 2.11.57
- security Advisory GHSA-w4v4-9rw7-5326 in 2.11.57
- security Advisory GHSA-7ghq-v6jf-g56c in 2.11.56
- security Advisory GHSA-rf44-j88r-hh8c in 2.11.56
- security Advisory GHSA-5w68-77r2-r64c in 2.11.55
- security Advisory GHSA-g55h-rg46-x9c5 in 2.11.55
- security Advisory GHSA-62fc-8686-hfmq in 2.11.54
- security Advisory GHSA-3ccp-42pg-hgv6 in 2.11.53
- security Advisory GHSA-cxjq-mrr5-89rv in 2.11.52
Every release in between
fix[server] Reject CONNECT requests regardless of HTTP version ( @juliens)
fix[server] Reject CONNECT method before reaching the muxer ( @juliens)
fixBump golang.org/x/net to v0.60.0 ( @kevinpollet)
securityAdvisory GHSA-cw35-4q88-3rmp
securityAdvisory GHSA-fh26-gfpp-7xxx
securityAdvisory GHSA-qm9f-w54v-q2qh
securityAdvisory GHSA-2272-4vv8-65ww
securityAdvisory GHSA-mhjw-hmjv-p99x
fix[docker] Bump github.com/docker/cli to v29.8.1 ( @kevinpollet)
fix[rules] Ignore negated matchers when parsing rule domains ( @rtribotte)
fix[server] Bump golang.org/x/crypto to v0.57.0 ( @kevinpollet)
fix[server] Ensure that the request TLS state is always set ( @rtribotte)
fix[service] Dedicate a sticky transport per ServersTransport ( @sdelicata)
fix[service] Isolate preauthenticated NTLM and Kerberos backend connections ( @kevinpollet)
fix[udp] Copy UDP datagrams into right-sized buffers before queuing ( @rtribotte)
securityAdvisory GHSA-qqjf-53cj-pwvv
securityAdvisory GHSA-f52w-8j3h-j724
securityAdvisory GHSA-w4v4-9rw7-5326
fix[acme] Disable recursive nss propagation by default for DNS challenge ( @rtribotte)
fix[http3] Dedicate a transport per HTTP/3 client connection ( @sdelicata)
fix[server] Deny request with an opaque request target ( @sdelicata)
fix[server] Do not forward h2c upgrade headers to the backend ( @sdelicata)
securityAdvisory GHSA-7ghq-v6jf-g56c
securityAdvisory GHSA-rf44-j88r-hh8c
fix[http3] Apply read timeout, idle timeout, and max header bytes for HTTP/3 ( @gndz07)
fix[server] Add an entry point option to handle request headers with aliasing names ( @rtribotte)
fix[tcp, udp] Reject negative weights in TCP and UDP weighted services ( @rtribotte)
fixBump etcd client modules to v3.5.33 ( @mmatur)
securityAdvisory GHSA-5w68-77r2-r64c
securityAdvisory GHSA-g55h-rg46-x9c5
fix[k8s/crd] Prevent generated name collisions in the Kubernetes CRD provider ( @rtribotte)
fix[k8s/crd] Add an option to restrict the namespace of the default TLS resources ( @rtribotte)
fix[k8s/crd] Scope generated Kubernetes Service names to their parent in the CRD provider ( @rtribotte)
fix[k8s/crd] Add safe naming option to avoid collisions for Kubernetes CRD provider ( @gndz07)
fix[k8s/gatewayapi] Fix Gateway API router rules ( @rtribotte)
fix[middleware, authentication] Bump github.com/containous/go-http-auth to b975dcaa8c48 ( @kevinpollet)
fix[tls] Add an option to disable the fallback to the default TLS options ( @rtribotte)
fixBump golang.org/x dependencies ( @mmatur)
securityAdvisory GHSA-62fc-8686-hfmq
fix[tracing] Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 ( @kevinpollet)
fixBump golang.org/x/text to v0.40.0 and golang.org/x/net v0.57.0 ( @mmatur)
fix[k8s/crd] Fix cross-namespace service reference check in Kubernetes CRD provider ( @gndz07)
fix[middleware] Bump github.com/klauspost/compress to v1.18.7 ( @mmatur)
securityAdvisory GHSA-3ccp-42pg-hgv6
fix[middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs ( @kevinpollet)
fix[server] Defer the CONNECT payload until the backend accepts the tunnel ( @sdelicata)
fix[server] Bump google.golang.org/grpc to v1.82.1 ( @piscue)
fix[server] Do not add back CONNECT requests to the pool ( @kevinpollet)
featureAdd a migration note for CONNECT requests ( @kevinpollet)
securityAdvisory GHSA-cxjq-mrr5-89rv
fix[middleware] Sanitize replaced path in ReplacePathRegex middleware ( @kevinpollet)
fix[acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 ( @rtribotte)
fix[otel] Bump go.opentelemetry.io/otel to v1.44.0 ( @rtribotte)
fixFix changelog v2.11.51 ( @mmatur)