| GO-2026-4530 | — | Traefik affected by TLS ClientAuth Bypass on HTTP/3 in github.com/traefik/traefik | 23/02/2026 |
| GHSA-gv8r-9rw9-9697 | 높음10.0 | Traefik affected by TLS ClientAuth Bypass on HTTP/3 | 20/02/2026 |
| CVE-2026-25949 | 높음7.5 | Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managing STARTTLS requests. An unauthenticated client can bypass Traefik entrypoint respondingTimeouts.readTimeout by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing con | 12/02/2026 |
| CVE-2026-22045 | 높음7.5 | Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates' automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up go routines and file descriptors indefinitely when the ACME TLS challenge is | 15/01/2026 |
| CVE-2025-66491 | 보통5.9 | Traefik is an HTTP reverse proxy and load balancer. Versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to "on" (intending to enable backend TLS certificate verification) actually disables verification, allowing man-in- | 09/12/2025 |
| CVE-2025-66490 | 보통6.5 | Traefik is an HTTP reverse proxy and load balancer. For versions prior to 2.11.32 and 2.11.31 through 3.6.2, requests using PathPrefix, Path or PathRegex matchers can bypass path normalization. When Traefik uses path-based routing, requests containing URL-encoded restricted characters (/, \, Null, ;, ?, #) can bypass t | 09/12/2025 |
| CVE-2025-54386 | 심각9.8 | Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discovered in WASM Traefik’s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with ../ sequences, an attacker can ov | 02/08/2025 |
| CVE-2025-47952 | 심각9.1 | Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. Prior to versions 2.11.25 and 3.4.1, there is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backend using a matcher based on the path | 30/05/2025 |
| GO-2025-3627 | — | Traefik affected by Go HTTP Request Smuggling Vulnerability in github.com/traefik/traefik | 22/04/2025 |
| CVE-2025-32431 | 심각9.1 | Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. In versions prior to 2.11.24, 3.3.6, and 3.4.0-rc2. There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backend using a matcher ba | 21/04/2025 |
| GO-2024-3342 | — | Traefik affected by CVE-2024-53259 in github.com/traefik/traefik | 20/12/2024 |
| CVE-2024-52003 | 보통6.1 | Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source. This issue has been addressed in versions 2.11.14 and 3.2.1. Users are advised to upgrade. There are no known workarounds | 29/11/2024 |
| CVE-2024-45410 | 높음7.5 | Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it should not be possible to remove or modify these headers. Since | 19/09/2024 |
| CVE-2024-39321 | 높음7.5 | Traefik is an HTTP reverse proxy and load balancer. Versions prior to 2.11.6, 3.0.4, and 3.1.0-rc3 have a vulnerability that allows bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes sent with spoofed IP addresses. Versions 2.11.6, 3.0.4, and 3.1.0-rc3 contain a patch for this issue. No kn | 05/07/2024 |
| GO-2024-2941 | — | ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/traefik/traefik | 28/06/2024 |
| GO-2024-2917 | — | Traefik has unexpected behavior with IPv4-mapped IPv6 addresses in github.com/traefik/traefik | 14/06/2024 |
| GHSA-7jmw-8259-q9jx | 보통 | Traefik has unexpected behavior with IPv4-mapped IPv6 addresses | 11/06/2024 |
| GO-2024-2726 | — | Traefik affected by HTTP/2 CONTINUATION flood in net/http in github.com/traefik/traefik | 05/06/2024 |
| GO-2024-2880 | — | Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop in github.com/traefik/traefik | 05/06/2024 |
| GHSA-f7cq-5v43-8pwp | 보통5.3 | Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop | 23/05/2024 |