Is Traefik 2.8.3 affected?

Vulnerabilities affecting 2.8.3

• 9.8
  CVE-2024-45410 HTTP client can remove the X-Forwarded headers
• 9.3
  GHSA-5w68-77r2-r64c Complete authentication bypass in the `digestAuth` middleware
• 8.8
  CVE-2026-88009 Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
• 8.2
  GHSA-g55h-rg46-x9c5 TLS option confusion in multi-host routers can bypass mTLS for protected hosts
• 7.8
  GHSA-cxjq-mrr5-89rv Authentication Bypass via Path Traversal in ReplacePathRegex Middleware
• 7.8
  CVE-2026-53622 HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
• 7.8
  CVE-2026-48020 Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
• 7.8
  CVE-2026-40912 StripPrefixRegex auth bypass via Path/RawPath desync
• 7.8
  CVE-2026-35051 ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth
• 7.8
  CVE-2026-39858 Forwarded alias spoofing top pre-auth decision bypass
• 7.8
  CVE-2026-33186 Fix CVE-2026-33186
• 7.8
  CVE-2026-32305 Potential mTLS Bypass via Fragmented TLS ClientHello Causing Pre-SNI Sniff Fallback to Default Non-mTLS TLS Config
• 7.8
  CVE-2025-68121 TLS ClientAuth Bypass on HTTP/3
• 7.8
  CVE-2025-66490 Path Normalization Bypass in Traefik Router + Middleware Rules
• 7.7
  CVE-2026-27141 HTTP/2 frames can cause a running server to panic
• 7.5
  CVE-2026-26999 TLS Handshake Error Handling Allows Stalled Connections on TCP Routers
• 7.5
  CVE-2024-39321 Bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes
• 7.3
  CVE-2025-54386 Path Traversal in WASM Client Plugin
• 7.0
  GHSA-hrpp-p4fc-wwf8 ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients
• 7.0
  GHSA-fh26-gfpp-7xxx snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`)
• 7.0
  CVE-2026-71324 Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool
• 6.9
  GHSA-2272-4vv8-65ww Negated Host matcher causes a TLS option conflict that disables client-certificate authentication on the excluded host
• 6.9
  CVE-2026-54764 ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false
• 6.9
  CVE-2026-41181 Errors middleware forwards Authorization and Cookie headers to separate error page service
• 6.4
  GHSA-rh7m-2m44-x32f Traefik: Kubernetes Ingress and Service annotations allow cross-namespace references to Middlewares, ServersTransports, and TLSOptions
• 6.4
  CVE-2026-44774 Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false
• 6.3
  CVE-2026-41263 BasicAuth middleware: timing side-channel vulnerability
• 6.3
  CVE-2026-32695 Ingress Rule Injection Allows Host Restriction Bypass in Traefik
• 6.3
  CVE-2026-32595 BasicAuth Middleware Timing Attack Allows Username Enumeration
• 6.1
  CVE-2026-29777 Kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values
• 5.9
  CVE-2026-22045 ACME TLS-ALPN fast path lacks timeouts and close on handshake stall
• 5.3
  CVE-2026-88012 respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded
• 5.3
  CVE-2026-88011 ForwardAuth identity spoofing via dot-form header alias
• 5.1
  CVE-2026-33433 BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField
• 4.8
  CVE-2026-71325 `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef
• 4.8
  CVE-2026-41174 Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding
• 4.4
  CVE-2026-26998 ForwardAuth Middleware Allows Unbounded Response Body, Causing Potential Denial of Service
• high
  CVE-2026-54763 Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
• low
  CVE-2025-47952 Path traversal still possible using url encoding
• high
  CVE-2025-32431 Path Matchers Vulnerability
• medium
  CVE-2024-53259 Fix CVE-2024-53259
• low
  CVE-2024-52003 X-Forwarded-Prefix Header allows for Open Redirect
• medium
  CVE-2024-35255 ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability
• medium
  CVE-2024-24790 Unexpected behavior with IPv4-mapped IPv6 addresses
• medium
  CVE-2024-24787 Malformed DNS message can cause infinite loop
• medium
  CVE-2023-45288 Fix CVE-2023-45288 - HTTP/2 CONTINUATION flood in net/http
• high
  CVE-2024-28869 Possible DoS vulnerability with Content-length header
• medium
  CVE-2023-47124 Potential DDoS whith ACME HTTPChallenge
• medium
  CVE-2023-47633 Uses 100% CPU after request to with host `traefik-service`
• low
  CVE-2023-47106 Incorrect processing of fragment in the URL leads to Authorization Bypass
• medium
  GHSA-7v4p-328v-8v5g HTTP/2 request could cause a deny of service
• high
  CVE-2023-29013 HTTP header parsing could cause a deny of service
• medium
  CVE-2022-23469 Authorization header displayed in the debug logs fixed in 2.9.6
• high
  CVE-2022-46153 Routes exposed with an empty TLSOption fixed in 2.9.6
• high
  CVE-2022-39271 HTTP/2 connections management could cause a deny of service fixed in 2.8.8

Newer releases