Go/github.com/traefik/traefik CVE-2026-71324: high, EPSS 1.06%

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-3ccp-42pg-hgv6#Go/github.com/traefik/traefik
• https://github.com/traefik/traefik/security/advisories/GHSA-3ccp-42pg-hgv6
• https://github.com/traefik/traefik/pull/13542
• https://github.com/traefik/traefik/pull/13543
• https://github.com/traefik/traefik/pull/13556
• https://github.com/traefik/traefik/commit/04d36f28e4eae7535e96a6351dd9f7bfb48a30e7
• https://github.com/traefik/traefik/commit/0807b6d5dd1da8b2f7f4076ea2392b5437bf2ab0
• https://github.com/traefik/traefik/commit/94a7508817d180f0ab2f1eae93df48d4ab19ecce
• https://github.com/traefik/traefik
• https://github.com/traefik/traefik/releases/tag/v2.11.53
• https://github.com/traefik/traefik/releases/tag/v3.6.24
• https://github.com/traefik/traefik/releases/tag/v3.7.9

CVE-2026-71324 · published 2026-08-06T15:56:40Z · modified 2026-08-18T15:10:47.771430180Z · JSON