7

CVE-2026-71324

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNECT with a keep-alive non-2xx response and does not drain the body, Traefik returns the desynchronized backend socket to its shared pool and reuses it for other clients. An unauthenticated attacker can use this behavior to make a different client read the attacker's smuggled response, which can include authenticated or private content from another request. The ForwardAuth middleware with forwardBody true and preserveRequestMethod true can re-issue a CONNECT with the buffered body attached, exposing the auth-client pool to the same desynchronization. This issue is fixed in 2.11.53, 3.6.24, and 3.7.9.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellertraefik
≫
Produkt traefik
Version < 2.11.53
Status affected
Version >= 3.0.0, < 3.6.24
Status affected
Version >= 3.7.0, < 3.7.9
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.55% 0.431
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 7 0 0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

https://github.com/traefik/traefik/commit/04d36f28e4eae7535e96a6351dd9f7bfb48a30e7
https://github.com/traefik/traefik/commit/0807b6d5dd1da8b2f7f4076ea2392b5437bf2ab0
https://github.com/traefik/traefik/commit/94a7508817d180f0ab2f1eae93df48d4ab19ecce
https://github.com/traefik/traefik/pull/13542
https://github.com/traefik/traefik/pull/13543
https://github.com/traefik/traefik/pull/13556
https://github.com/traefik/traefik/releases/tag/v2.11.53
https://github.com/traefik/traefik/releases/tag/v3.6.24
https://github.com/traefik/traefik/releases/tag/v3.7.9
https://github.com/traefik/traefik/security/advisories/GHSA-3ccp-42pg-hgv6