CVE-2026-71324

Received Received - Intake

HTTP/2 Request Smuggling in Traefik

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNECT with a keep-alive non-2xx response and does not drain the body, Traefik returns the desynchronized backend socket to its shared pool and reuses it for other clients. An unauthenticated attacker can use this behavior to make a different client read the attacker's smuggled response, which can include authenticated or private content from another request. The ForwardAuth middleware with forwardBody true and preserveRequestMethod true can re-issue a CONNECT with the buffered body attached, exposing the auth-client pool to the same desynchronization. This issue is fixed in 2.11.53, 3.6.24, and 3.7.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-71324

Affected Vendors & Products

Vendor	Product	Version / Range
traefik	traefik	to 2.11.53 (exc)
traefik	traefik	to 3.6.24 (exc)
traefik	traefik	to 3.7.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

Traefik is an HTTP reverse proxy and load balancer. This vulnerability involves a flaw where Traefik forwards HTTP/2 or HTTP/3 CONNECT requests and their bodies to an HTTP/1.1 upstream using a shared connection pool. If the upstream responds with a non-2xx keep-alive response without draining the body, Traefik reuses the connection for other clients. This allows an attacker to send a smuggled response that another client might read, potentially exposing sensitive or authenticated content.

Impact Analysis

An unauthenticated attacker could exploit this to read responses intended for other users, including private or authenticated data. This could lead to data leaks, unauthorized access, or session hijacking if sensitive information is exposed through the desynchronized connections.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of personal or sensitive data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. Organizations using affected Traefik versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade Traefik to version 2.11.53, 3.6.24, or 3.7.9 or later to address the vulnerability. If upgrading is not immediately possible, disable HTTP/2 and HTTP/3 support or avoid using the ForwardAuth middleware with forwardBody true and preserveRequestMethod true.

Hi! I’m here to help you understand CVE-2026-71324. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70