Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1115
_____________________________________________________________________

DATE                : 02/11/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running traefik/v2 (Go) versions
                              prior to 2.11.61,
                   traefik/v3 (Go) versions prior to 3.7.17.

====================================================================
https://github.com/traefik/traefik/security/advisories/GHSA-xv5x-242w-7hf7
_____________________________________________________________________


Per-connection backend transport leak from unauthenticated
Negotiate/NTLM headers (3.7.14+)

This report was submitted with AI assistance
High
kevinpollet published GHSA-xv5x-242w-7hf7 Nov 2, 2026

Package
github.com/traefik/traefik/v2 (Go)

Affected versions
>= v2.11.58, <= v2.11.60

Patched versions
v2.11.61

github.com/traefik/traefik/v3 (Go)
Affected versions
>= v3.7.14, <= v3.7.16
Patched versions
v3.7.17


Description

Summary

There is a high severity vulnerability in Traefik's NTLM and Kerberos
backend connection handling. Since v2.11.58 and v3.7.14, Traefik
allocates a dedicated backend transport to a client connection as soon
as a request carries an Authorization header with the NTLM or Negotiate
scheme, without any valid credential or backend challenge. This
transport, its idle backend connection and its goroutines are not
released when the client connection closes, and the same pattern exists
in FastProxy. An unauthenticated client can therefore open many short-lived
connections and exhaust the memory, file descriptors and backend connections
of the Traefik process, regardless of whether NTLM or Kerberos backends
are configured. Traefik v3.6 and earlier v3 lines, and Traefik v2.11.57
and earlier, are not affected: they only dedicate a transport after the
backend answers with a WWW-Authenticate: NTLM or Negotiate challenge.


Patches

    https://github.com/traefik/traefik/releases/tag/v2.11.61
    https://github.com/traefik/traefik/releases/tag/v3.7.17

For more information

If you have any questions or comments about this advisory, please open
an issue.


Severity
High
7.5/ 10

CVSS v3 base metrics
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE ID
No known CVE

Weaknesses
Weakness CWE-400
Weakness CWE-772

Credits

    @MayseenAidoudi MayseenAidoudi Reporter


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================