CVE-2026-71324

Go/github.com/traefik/traefik/v2 CVE-2026-71324: high, EPSS 1.06%

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Action: Upgrade github.com/traefik/traefik/v2 to 2.11.53 or later.

go get github.com/traefik/traefik/v2@v2.11.53

Affected

Fixed versions

Sources

• osv: GHSA-3ccp-42pg-hgv6
• https://github.com/traefik/traefik/security/advisories/GHSA-3ccp-42pg-hgv6
• https://github.com/traefik/traefik/pull/13542
• https://github.com/traefik/traefik/pull/13543
• https://github.com/traefik/traefik/pull/13556
• https://github.com/traefik/traefik/commit/04d36f28e4eae7535e96a6351dd9f7bfb48a30e7
• https://github.com/traefik/traefik/commit/0807b6d5dd1da8b2f7f4076ea2392b5437bf2ab0
• https://github.com/traefik/traefik/commit/94a7508817d180f0ab2f1eae93df48d4ab19ecce
• https://github.com/traefik/traefik
• https://github.com/traefik/traefik/releases/tag/v2.11.53
• https://github.com/traefik/traefik/releases/tag/v3.6.24
• https://github.com/traefik/traefik/releases/tag/v3.7.9

CVE-2026-71324 · published 2026-08-06T15:56:40Z · modified 2026-08-18T15:10:47.771430180Z · JSON

Go/github.com/traefik/traefik/v3 CVE-2026-71324: high, EPSS 1.06%

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Action: Upgrade github.com/traefik/traefik/v3 to 3.6.24 or later.

go get github.com/traefik/traefik/v3@v3.6.24

go get github.com/traefik/traefik/v3@v3.7.9

Affected

Fixed versions

Sources

• osv: GHSA-3ccp-42pg-hgv6#Go/github.com/traefik/traefik/v3
• https://github.com/traefik/traefik/security/advisories/GHSA-3ccp-42pg-hgv6
• https://github.com/traefik/traefik/pull/13542
• https://github.com/traefik/traefik/pull/13543
• https://github.com/traefik/traefik/pull/13556
• https://github.com/traefik/traefik/commit/04d36f28e4eae7535e96a6351dd9f7bfb48a30e7
• https://github.com/traefik/traefik/commit/0807b6d5dd1da8b2f7f4076ea2392b5437bf2ab0
• https://github.com/traefik/traefik/commit/94a7508817d180f0ab2f1eae93df48d4ab19ecce
• https://github.com/traefik/traefik
• https://github.com/traefik/traefik/releases/tag/v2.11.53
• https://github.com/traefik/traefik/releases/tag/v3.6.24
• https://github.com/traefik/traefik/releases/tag/v3.7.9

CVE-2026-71324 · published 2026-08-06T15:56:40Z · modified 2026-08-18T15:10:47.771430180Z · JSON

Go/github.com/traefik/traefik CVE-2026-71324: high, EPSS 1.06%

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-3ccp-42pg-hgv6#Go/github.com/traefik/traefik
• https://github.com/traefik/traefik/security/advisories/GHSA-3ccp-42pg-hgv6
• https://github.com/traefik/traefik/pull/13542
• https://github.com/traefik/traefik/pull/13543
• https://github.com/traefik/traefik/pull/13556
• https://github.com/traefik/traefik/commit/04d36f28e4eae7535e96a6351dd9f7bfb48a30e7
• https://github.com/traefik/traefik/commit/0807b6d5dd1da8b2f7f4076ea2392b5437bf2ab0
• https://github.com/traefik/traefik/commit/94a7508817d180f0ab2f1eae93df48d4ab19ecce
• https://github.com/traefik/traefik
• https://github.com/traefik/traefik/releases/tag/v2.11.53
• https://github.com/traefik/traefik/releases/tag/v3.6.24
• https://github.com/traefik/traefik/releases/tag/v3.7.9

CVE-2026-71324 · published 2026-08-06T15:56:40Z · modified 2026-08-18T15:10:47.771430180Z · JSON

Go/github.com/traefik/traefik CVE-2026-71324: unknown, EPSS 1.06%

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool in github.com/traefik/traefik

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-6201
• https://github.com/traefik/traefik/security/advisories/GHSA-3ccp-42pg-hgv6
• https://github.com/traefik/traefik/commit/04d36f28e4eae7535e96a6351dd9f7bfb48a30e7
• https://github.com/traefik/traefik/commit/0807b6d5dd1da8b2f7f4076ea2392b5437bf2ab0
• https://github.com/traefik/traefik/commit/94a7508817d180f0ab2f1eae93df48d4ab19ecce
• https://github.com/traefik/traefik/pull/13542
• https://github.com/traefik/traefik/pull/13543
• https://github.com/traefik/traefik/pull/13556
• https://github.com/traefik/traefik/releases/tag/v2.11.53
• https://github.com/traefik/traefik/releases/tag/v3.6.24
• https://github.com/traefik/traefik/releases/tag/v3.7.9

CVE-2026-71324 · published 2026-08-18T14:32:29Z · modified 2026-08-18T15:00:19.804323790Z · JSON

Go/github.com/traefik/traefik/v2 CVE-2026-71324: unknown, EPSS 1.06%

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool in github.com/traefik/traefik

Action: Upgrade github.com/traefik/traefik/v2 to 2.11.53 or later.

go get github.com/traefik/traefik/v2@v2.11.53

Affected

Fixed versions

Sources

• osv: GO-2026-6201#Go/github.com/traefik/traefik/v2
• https://github.com/traefik/traefik/security/advisories/GHSA-3ccp-42pg-hgv6
• https://github.com/traefik/traefik/commit/04d36f28e4eae7535e96a6351dd9f7bfb48a30e7
• https://github.com/traefik/traefik/commit/0807b6d5dd1da8b2f7f4076ea2392b5437bf2ab0
• https://github.com/traefik/traefik/commit/94a7508817d180f0ab2f1eae93df48d4ab19ecce
• https://github.com/traefik/traefik/pull/13542
• https://github.com/traefik/traefik/pull/13543
• https://github.com/traefik/traefik/pull/13556
• https://github.com/traefik/traefik/releases/tag/v2.11.53
• https://github.com/traefik/traefik/releases/tag/v3.6.24
• https://github.com/traefik/traefik/releases/tag/v3.7.9

CVE-2026-71324 · published 2026-08-18T14:32:29Z · modified 2026-08-18T15:00:19.804323790Z · JSON

Go/github.com/traefik/traefik/v3 CVE-2026-71324: unknown, EPSS 1.06%

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool in github.com/traefik/traefik

Action: Upgrade github.com/traefik/traefik/v3 to 3.6.24 or later.

go get github.com/traefik/traefik/v3@v3.6.24

go get github.com/traefik/traefik/v3@v3.7.9

Affected

Fixed versions

Sources

• osv: GO-2026-6201#Go/github.com/traefik/traefik/v3
• https://github.com/traefik/traefik/security/advisories/GHSA-3ccp-42pg-hgv6
• https://github.com/traefik/traefik/commit/04d36f28e4eae7535e96a6351dd9f7bfb48a30e7
• https://github.com/traefik/traefik/commit/0807b6d5dd1da8b2f7f4076ea2392b5437bf2ab0
• https://github.com/traefik/traefik/commit/94a7508817d180f0ab2f1eae93df48d4ab19ecce
• https://github.com/traefik/traefik/pull/13542
• https://github.com/traefik/traefik/pull/13543
• https://github.com/traefik/traefik/pull/13556
• https://github.com/traefik/traefik/releases/tag/v2.11.53
• https://github.com/traefik/traefik/releases/tag/v3.6.24
• https://github.com/traefik/traefik/releases/tag/v3.7.9

CVE-2026-71324 · published 2026-08-18T14:32:29Z · modified 2026-08-18T15:00:19.804323790Z · JSON