Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, a form of HTTP request smuggling, exists in how Traefik's default reverse proxy handles HTTP/2 and HTTP/3 CONNECT requests. An attacker could send a CONNECT request with a malicious payload in its body. Traefik would forward this to a backend HTTP/1.1 server over a persistent (keep-alive) connection.
The core of the issue is that if the backend server responded with a non-2xx status (e.g., '405 Method Not Allowed') but did not close the connection, Traefik would incorrectly return the connection to a shared pool. However, the backend server might still process the attacker's payload from the initial request's body as a pipelined request. When a victim's request then reuses this tainted connection from the pool, it receives the response generated by the attacker's smuggled request, leading to cross-user response poisoning.
The analysis of the patches confirms this. The fix in pkg/server/service/proxy.go within the buildProxy function now explicitly sets the Connection: close header for all CONNECT requests, ensuring the connection is never returned to the pool and reused. Additionally, the forwardAuth.ServeHTTP function in pkg/middlewares/auth/forward.go was patched to stop forwarding the body of CONNECT requests to authentication servers, preventing a similar smuggling issue in that context. Finally, a new handler, connectHandler, was introduced to defer the CONNECT payload until the backend explicitly accepts the tunnel, providing a more robust fix.
buildProxypkg/server/service/proxy.go
forwardAuth.ServeHTTPpkg/middlewares/auth/forward.go
connectHandler.ServeHTTPpkg/server/service/connect.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/traefik/traefik/v2 | go | <= 2.11.52 | 2.11.53 |
| github.com/traefik/traefik/v3 | go | <= 3.6.23 | 3.6.24 |
| github.com/traefik/traefik/v3 | go | >= 3.7.0, <= 3.7.8 | 3.7.9 |
| github.com/traefik/traefik | go | <= 1.7.34 |