Traefik 2.11.56 → 2.11.59
3 releases · 0 breaking changes · 8 security fixes · 8 advisories fixed
8security0breaking0deprecated0feature14fix
Vulnerabilities fixed by this upgrade
- 6.3 GHSA-mhjw-hmjv-p99x Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/2 streams
- 6.9 GHSA-2272-4vv8-65ww Negated Host matcher causes a TLS option conflict that disables client-certificate authentication on the excluded host
- 7.0 GHSA-cw35-4q88-3rmp Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one service TLS client config to another
- 7.0 GHSA-qm9f-w54v-q2qh Preauthenticated Negotiate contaminates Traefik's globally shared backend connection pool
- 7.0 GHSA-fh26-gfpp-7xxx snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`)
- 7.0 CVE-2026-88008 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization in github.com/traefik/traefik/v3
- 9.1 CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse
- 8.8 CVE-2026-88009 Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
Breaking changes
None in the release notes.
Security changes
- security Advisory GHSA-cw35-4q88-3rmp in 2.11.58
- security Advisory GHSA-fh26-gfpp-7xxx in 2.11.58
- security Advisory GHSA-qm9f-w54v-q2qh in 2.11.58
- security Advisory GHSA-2272-4vv8-65ww in 2.11.58
- security Advisory GHSA-mhjw-hmjv-p99x in 2.11.58
- security Advisory GHSA-qqjf-53cj-pwvv in 2.11.57
- security Advisory GHSA-f52w-8j3h-j724 in 2.11.57
- security Advisory GHSA-w4v4-9rw7-5326 in 2.11.57
Every release in between
fix[server] Reject CONNECT requests regardless of HTTP version ( @juliens)
fix[server] Reject CONNECT method before reaching the muxer ( @juliens)
fixBump golang.org/x/net to v0.60.0 ( @kevinpollet)
securityAdvisory GHSA-cw35-4q88-3rmp
securityAdvisory GHSA-fh26-gfpp-7xxx
securityAdvisory GHSA-qm9f-w54v-q2qh
securityAdvisory GHSA-2272-4vv8-65ww
securityAdvisory GHSA-mhjw-hmjv-p99x
fix[docker] Bump github.com/docker/cli to v29.8.1 ( @kevinpollet)
fix[rules] Ignore negated matchers when parsing rule domains ( @rtribotte)
fix[server] Bump golang.org/x/crypto to v0.57.0 ( @kevinpollet)
fix[server] Ensure that the request TLS state is always set ( @rtribotte)
fix[service] Dedicate a sticky transport per ServersTransport ( @sdelicata)
fix[service] Isolate preauthenticated NTLM and Kerberos backend connections ( @kevinpollet)
fix[udp] Copy UDP datagrams into right-sized buffers before queuing ( @rtribotte)
securityAdvisory GHSA-qqjf-53cj-pwvv
securityAdvisory GHSA-f52w-8j3h-j724
securityAdvisory GHSA-w4v4-9rw7-5326
fix[acme] Disable recursive nss propagation by default for DNS challenge ( @rtribotte)
fix[http3] Dedicate a transport per HTTP/3 client connection ( @sdelicata)
fix[server] Deny request with an opaque request target ( @sdelicata)
fix[server] Do not forward h2c upgrade headers to the backend ( @sdelicata)