9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-5423-jcjm-2gpv

GHSA-5423-jcjm-2gpv: Traefik affected by Go HTTP Request Smuggling Vulnerability

Summary

net/http: request smuggling through invalid chunked data: The net/http package accepts data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permit request smuggling. [CVE-2025-22871] Vendor Affected Components: Go: 1.23.x < 1.23.8

More Details: CVE-2025-22871

Patches

https://github.com/traefik/traefik/releases/tag/v2.11.24
https://github.com/traefik/traefik/releases/tag/v3.3.6
https://github.com/traefik/traefik/releases/tag/v3.4.0-rc2

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-5423-jcjm-2gpv

GHSA-5423-jcjm-2gpv:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/traefik/traefik/v2	go	< 2.11.24	2.11.24
github.com/traefik/traefik/v3	go	< 3.3.6	3.3.6
github.com/traefik/traefik/v3	go	= 3.4.0-rc1	3.4.0-rc2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2025-22871 is a request smuggling issue within the Go net/http package, which Traefik uses as a dependency (via golang.org/x/net). The primary patch addressing this, identified from the commit history around the tagged releases, is commit 7442162e3f108544b495d4db523696bf51b64184. This commit updates the golang.org/x/net dependency from v0.37.0 to v0.38.0 in the go.mod and go.sum files. This change indicates that Traefik was using a version of the underlying library susceptible to the vulnerability. However, the patch itself does not modify any of Traefik's own Go source code files. While Traefik's HTTP request handling functions would inevitably call into the vulnerable net/http code and would appear in a runtime profile during exploitation, these specific Traefik functions are not directly identifiable as 'vulnerable' (in terms of containing the flawed logic) or 'modified for mitigation' from the provided patch evidence of Traefik's own codebase. The vulnerability originates in the third-party dependency, and the mitigation shown in the patch is an update to that dependency. Therefore, no specific functions within Traefik's codebase can be listed with direct patch evidence of their vulnerability or modification based on the provided commit information.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.