Traefik affected by TLS ClientAuth Bypass on HTTP/3

ALTO 10.0GHSA-gv8r-9rw9-9697 · GO-2026-4530 · Published 20/02/2026 · updated 13/03/2026

En resumen

GHSA-gv8r-9rw9-9697 es una vulnerabilidad ALTO (CVSS 10.0) que afecta a github.com/traefik/traefik, github.com/traefik/traefik/v2, github.com/traefik/traefik/v3.
Solución: actualizar a 2.11.37, 3.6.8 o posterior.

Package	Affected versions	Patched versions
github.com/traefik/traefik Go	`≤ 1.7.34`	No fix yet
github.com/traefik/traefik/v2 Go	`< 2.11.37`	`2.11.37`
github.com/traefik/traefik/v3 Go	`< 3.6.8`	`3.6.8`

There is a potential vulnerability in Traefik managing HTTP/3 connections.

More details in the CVE-2025-68121.

No workaround

If you have any questions or comments about this advisory, please open an issue.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≤ 1.7.34

No fix yet

< 2.11.37

2.11.37

< 3.6.8

3.6.8

Description

There is a potential vulnerability in Traefik managing HTTP/3 connections.

More details in the CVE-2025-68121.

No workaround

If you have any questions or comments about this advisory, please open an issue.

Más vulnerabilidades de github.com/traefik/traefik

Ver todo →