Traefik 3.7.15 → 3.7.18

3 releases · 0 breaking changes · 2 security fixes · 2 advisories fixed

2security0breaking0deprecated1feature36fix

Is 3.7.15 affected?

Vulnerabilities fixed by this upgrade

7.5 GHSA-xv5x-242w-7hf7 Per-connection backend transport leak from unauthenticated Negotiate/NTLM headers (3.7.14+)
7.0 GHSA-hrpp-p4fc-wwf8 ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients

Breaking changes

None in the release notes.

Security changes

security [security] Point security announcements to GitHub advisories ( @nmengin) in 3.7.17
security Advisory GHSA-hrpp-p4fc-wwf8 in 3.7.16

Every release in between

3.7.18 Nov 10, 2026 Release notes ↗

fix[authentication] Limit BasicAuth password length ( @Neffi42)

fix[authentication] Support connection-bound authentication schemes in Proxy-Authorization ( @Neffi42)

fix[k8s/ingress-nginx] Apply host-less auth-tls annotations to the default TLS option ( @rtribotte)

fix[k8s/ingress-nginx] Apply Ingress NGINX CORS before the redirect annotations ( @lazerg)

fix[k8s/ingress-nginx] Fix Ssl-Client-* headers when Ingresses share a host ( @Neffi42)

fix[k8s/knative] Bump knative.dev/pkg to v0.0.0-20261102011501-7b6dcbbe4ea4 ( @kevinpollet)

fix[middleware] Accept uppercase Q weight in compress Accept-Encoding parsing ( @locker95)

fix[middleware] Bump github.com/vulcand/oxy to v2.3.2 ( @ldez)

fix[middleware, performance] Limit zstd encoder memory in the Compress middleware ( @juliens)

fix[plugins] Fix deterministic randomness in WASM plugins ( @yugfletcher)

fix[plugins] Bump github.com/traefik/yaegi to v0.16.3 ( @juliens)

fix[server] Validate HTTP Host matcher values ( @Milad93R)

fix[server] Resolve dot-segments and empty segments with path parameters ( @Neffi42)

fix[server, grpc] Add regression test for gRPC bidirectional streams ( @ozenyunus35)

fix[service] Fix SPIFFE configuration for the TCP servers transport ( @simpleqt)

fix[tcp] Detect TCP connection reset on read when the error is wrapped ( @noakky)

other[k8s/ingress-nginx] List missing ingress-nginx annotations as unsupported ( @lazerg)

other[middleware] Use a Secret for basicAuth in the Chain middleware Kubernetes example ( @lazerg)

other[middleware] Fix grammar in observability and InFlightReq pages ( @m-shahi)

other[plugins] Fix typos in plugin type error and documentation ( @sarankumar1325)

featureAdd version to the dot-segments migration note ( @kevinpollet)

fixFix Docker Hub link in README ( @GUOZIJAN)

fixFix broken anchors in providers overview, SPIFFE and v3 migration docs ( @SatvikMishra08)

fixFix dead and redirecting external links ( @rachana5)

otherMove AI assistance disclosure to the pull request description ( @Neffi42)

otherUpdate download and GitHub star counts ( @tomatokoolaid)

3.7.17 Oct 30, 2026 Release notes ↗

fix[acme] Bump github.com/go-acme/lego/v5 to v5.6.0 ( @ldez)

fix[acme] Bump github.com/go-jose/go-jose/v4 to v4.1.6 ( @Mheaus)

fix[http3] Bump github.com/quic-go/quic-go to v0.64.1 ( @janpachol)

fix[k8s/gatewayapi] Preserve Gateway status conditions owned by other controllers ( @Neffi42)

fix[k8s/ingress-nginx] Avoid generated name collisions across namespaces in the ingress-nginx provider ( @Neffi42)

fix[logs, k8s/gatewayapi] Lower user configuration error logs to debug ( @rtribotte)

fix[middleware] Bump github.com/andybalholm/brotli to v1.2.7 ( @albe2669)

fix[middleware] Fix broken flush, hijack, and deadlines in wrapped ResponseWriters ( @Neffi42)

fix[middleware, authentication, k8s/crd, k8s, k8s/ingress-nginx] Resolve secret references when building middlewares ( @sdelicata)

fix[server] Add an entry point option to limit the number of request header values ( @juliens)

fix[server] Add global default for aliasHeadersStrategy ( @nikolas-sapa)

fix[server] Bump golang.org/x/net to v0.62.0 ( @kevinpollet)

fix[server] Fix backend connection leak for NTLM and Kerberos authentication ( @juliens)

fix[server, fastproxy] Fix FastProxy backend connection leak for NTLM and Kerberos ( @juliens)

other[docker] Update Docker Basic guide to use Traefik v3.7 ( @Saku0512)

security[security] Point security announcements to GitHub advisories ( @nmengin)

3.7.16 Oct 20, 2026 Release notes ↗

securityAdvisory GHSA-hrpp-p4fc-wwf8

fix[authentication, service, k8s/ingress-nginx] Support NTLM and Kerberos in ForwardAuth and ingress-nginx auth-url ( @juliens)

fix[authentication, service] Support NTLM and Kerberos authentication in ForwardAuth ( @juliens)

fix[k8s/gatewayapi] Fix Gateway API conformance suite setup with the containerd image store ( @Neffi42)

other[k8s/ingress-nginx] Document that rewrite is supported in configuration-snippet ( @bingtang9)