Go/github.com/traefik/traefik/v2 CVE-2024-39321: unknown, EPSS 0.59%

Bypassing IP allow-lists in traefik via HTTP/3 early data requests in QUIC 0-RTT handshakes in github.com/traefik/traefik

Action: Upgrade github.com/traefik/traefik/v2 to 2.11.6 or later.

go get github.com/traefik/traefik/v2@v2.11.6

Affected

Fixed versions

Sources

• osv: GO-2024-2973#Go/github.com/traefik/traefik/v2
• https://github.com/traefik/traefik/security/advisories/GHSA-gxrv-wf35-62w9
• https://nvd.nist.gov/vuln/detail/CVE-2024-39321
• https://github.com/traefik/traefik/releases/tag/v2.11.6
• https://github.com/traefik/traefik/releases/tag/v3.0.4
• https://github.com/traefik/traefik/releases/tag/v3.1.0-rc3

CVE-2024-39321 · published 2024-07-09T19:34:07Z · modified 2026-03-03T04:55:33.607072Z · JSON