Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

traefik Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Affected product	Published	Severity

`CVE-2026-88012`Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published09/10/2026	SeverityMedium
`CVE-2026-88011`Traefik: ForwardAuth identity spoofing via dot-form header alias	Exploitation statusNot confirmed	FixNot confirmed	Affected producttraefik	Published09/10/2026	SeverityMedium
`CVE-2026-88009`Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published09/10/2026	SeverityHigh
`CVE-2026-88008`Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published09/10/2026	SeverityHigh
`CVE-2026-88007`Traefik HTTP/3 Backend NTLM Connection Reuse	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published09/10/2026	SeverityCritical
`CVE-2026-88004`Traefik entrypoint header-name sanitization bypassed via request trailers	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published09/10/2026	SeverityHigh
`CVE-2026-88879`Traefik before v2.11.56 Identity Spoofing via Header Alias	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published09/10/2026	SeverityMedium
`CVE-2026-88878`Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published09/10/2026	SeverityMedium
`CVE-2026-88877`Traefik v3.7.0 Authentication Bypass via from-to-www-redirect	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published09/10/2026	SeverityCritical
`CVE-2026-85597`Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published09/04/2026	SeverityHigh
`CVE-2026-85596`Traefik v3.7 Authentication Bypass via TLS Option Conflict	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published09/04/2026	SeverityHigh
`CVE-2026-85595`Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published09/04/2026	SeverityCritical
`CVE-2026-85594`Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published09/04/2026	SeverityHigh
`CVE-2026-71327`Traefik: Gateway API route identity collision allows cross-namespace backend hijacking	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published08/06/2026	SeverityHigh
`CVE-2026-71326`Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published08/06/2026	SeverityLow
`CVE-2026-71325`Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published08/06/2026	SeverityMedium
`CVE-2026-71324`Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published08/06/2026	SeverityHigh
`CVE-2026-67309`Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published08/01/2026	SeverityHigh
`CVE-2026-65602`Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published07/22/2026	SeverityMedium
`CVE-2026-65601`Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published07/22/2026	SeverityMedium
`CVE-2026-65600`Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published07/22/2026	SeverityHigh
`CVE-2026-54763`Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published07/06/2026	SeverityHigh
`CVE-2026-54765`Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published07/06/2026	SeverityMedium
`CVE-2026-54764`ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published07/06/2026	SeverityMedium
`CVE-2026-54762`Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published06/23/2026	SeverityMedium
`CVE-2026-54761`Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published06/23/2026	SeverityMedium
`CVE-2026-53622`Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published06/23/2026	SeverityHigh
`CVE-2026-48491`Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published06/23/2026	SeverityHigh
`CVE-2026-48020`Traefik StripPrefix Route-Level Auth Bypass via Path Normalization	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published06/23/2026	SeverityHigh
`CVE-2023-54365`Traefik - Denial of Service via HTTP/2 Request Handling	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published06/23/2026	SeverityHigh
`CVE-2026-44774`Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published05/15/2026	SeverityMedium
`CVE-2026-41181`Traefik: Errors middleware forwards Authorization and Cookie headers to separate error page service	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published05/15/2026	SeverityMedium
`CVE-2026-41263`Traefik: BasicAuth middleware: timing side-channel vulnerability	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published04/30/2026	SeverityMedium
`CVE-2026-40912`Traefik: StripPrefixRegex auth bypass via Path/RawPath desync	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published04/30/2026	SeverityHigh
`CVE-2026-39858`Traefik: Forwarded alias spoofing top pre-auth decision bypass	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published04/30/2026	SeverityHigh
`CVE-2026-35051`Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published04/30/2026	SeverityHigh
`CVE-2026-41174`Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published04/30/2026	SeverityMedium
`CVE-2026-33433`Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField	Exploitation statusNot known exploited	FixNot confirmed	Affected producttraefik	Published03/27/2026	SeverityMedium
`CVE-2026-32695`Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass	Exploitation statusNot known exploited	FixNot confirmed	Affected producttraefik	Published03/27/2026	SeverityMedium
`CVE-2026-32595`Traefik: BasicAuth Middleware Timing Attack Allows Username Enumeration	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published03/20/2026	SeverityMedium
`CVE-2026-32305`Traefik mTLS bypass via fragmented ClientHello SNI extraction failure	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published03/20/2026	SeverityHigh
`CVE-2026-29777`Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published03/11/2026	SeverityMedium
`CVE-2026-29054`Traefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published03/05/2026	SeverityHigh
`CVE-2026-26999`Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS)	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published03/05/2026	SeverityHigh
`CVE-2026-26998`Traefik: unbounded io.ReadAll on auth server response body causes OOM denial of service(DOS)	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published03/05/2026	SeverityMedium
`CVE-2026-25949`Traefik: TCP readTimeout bypass via STARTTLS on Postgres	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published02/12/2026	SeverityHigh
`CVE-2026-22045`Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published01/15/2026	SeverityMedium
`CVE-2025-66491`Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published12/09/2025	SeverityMedium
`CVE-2025-66490`Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules	Exploitation statusPublic exploit	FixYes	Affected producttraefik	Published12/09/2025	SeverityMedium
`CVE-2025-54386`Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published08/01/2025	SeverityHigh
`CVE-2025-47952`Traefik allows path traversal using url encoding	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published05/30/2025	SeverityLow
`CVE-2025-32431`Traefik has a possible vulnerability with the path matchers	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published04/21/2025	SeverityHigh
`CVE-2024-52003`X-Forwarded-Prefix Header still allows for Open Redirect in traefik	Exploitation statusNot known exploited	FixNot confirmed	Affected producttraefik	Published11/29/2024	SeverityMedium
`CVE-2024-45410`HTTP client can remove the X-Forwarded headers in Traefik	Exploitation statusNot known exploited	FixNot confirmed	Affected producttraefik	Published09/19/2024	SeverityCritical
`CVE-2024-39321`Traefik vulnerable to bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes	Exploitation statusNot known exploited	FixNot confirmed	Affected producttraefik	Published07/05/2024	SeverityHigh
`CVE-2024-28869`Possible denial of service vulnerability with Content-length header in Traefik	Exploitation statusNot known exploited	FixNot confirmed	Affected producttraefik	Published04/12/2024	SeverityHigh
`CVE-2023-47633`Uncontrolled Resource Consumption in Traefik	Exploitation statusPublic exploit	FixNot confirmed	Affected producttraefik	Published12/04/2023	SeverityHigh
`CVE-2023-47106`Incorrect processing of fragment in the URL leads to Authorization Bypass in Traefik	Exploitation statusNot confirmed	FixNot confirmed	Affected producttraefik	Published12/04/2023	SeverityMedium
`CVE-2023-47124`Denial of service whith ACME HTTPChallenge in Traefik	Exploitation statusNot confirmed	FixNot confirmed	Affected producttraefik	Published12/04/2023	SeverityMedium
`CVE-2023-44487`	Exploitation statusKEV	FixNot confirmed	Affected productNot confirmed	Published10/10/2023	SeverityHigh
`CVE-2023-29013`HTTP header parsing could cause a deny of service	Exploitation statusNot known exploited	FixYes	Affected producttraefik	Published04/14/2023	SeverityHigh
`CVE-2022-46153`Routes exposed with an empty TLSOption in traefik	Exploitation statusNot known exploited	FixNot confirmed	Affected producttraefik	Published12/08/2022	SeverityHigh
`CVE-2022-23469`Authorization header displayed in the debug logs	Exploitation statusPublic exploit	FixNot confirmed	Affected producttraefik	Published12/08/2022	SeverityLow
`CVE-2022-39271`Traefik HTTP/2 connections management could cause a denial of service	Exploitation statusNot known exploited	FixNot confirmed	Affected producttraefik	Published10/11/2022	SeverityHigh
`CVE-2022-23632`Traefik skips the router TLS configuration when the host header is an FQDN	Exploitation statusNot known exploited	FixNot confirmed	Affected producttraefik	Published02/17/2022	SeverityHigh
`CVE-2021-32813`Drop Headers via Malicious Connection Header	Exploitation statusNot confirmed	FixYes	Affected producttraefik	Published08/03/2021	SeverityMedium
`CVE-2020-15129`Open redirect in Traefik	Exploitation statusNot confirmed	FixNot confirmed	Affected producttraefik	Published07/30/2020	SeverityMedium
`CVE-2019-20894`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published07/02/2020	SeverityUnknown
`CVE-2020-9321`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published03/16/2020	SeverityUnknown
`CVE-2019-12452`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published05/29/2019	SeverityUnknown
`CVE-2018-15598`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published08/21/2018	SeverityUnknown

71 / 71 Results

All vulnerabilities loaded

Security vulnerabilities from traefik

traefik

How many security vulnerabilities does traefik have?

Which traefik product has the most security vulnerabilities?

Filters

Run an in-depth assessment with complete web risk management

Popular traefik products

traefik