{"items":[{"id":"NVI-00014014","kind":"vulnerability","title":"Traefik entrypoint header-name sanitization bypassed via request trailers","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-v67p-phpq-fc8x","CVE-2026-88004"],"plain_summary":"GitHub lists this reviewed advisory for github.com/traefik/traefik/v3. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-313b6169475ad5c93bce30affec2767d"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-313b6169475ad5c93bce30affec2767d","url":"https://github.com/advisories/GHSA-v67p-phpq-fc8x","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-v67p-phpq-fc8x","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T22:54:05.264Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-313b6169475ad5c93bce30affec2767d"],"technology":"github.com/traefik/traefik/v3","known_exclusions":[],"conditions_summary":"## Summary\n\nTraefik's entrypoint defenses against spoofed trusted header names — `aliasHeadersStrategy` / `underscoreHeadersStrategy` in `delete` or `reject` mode, and the default `forwardedHeaders` stripping of client-supplied `X-Forwarded-*` — scan `req.Header` only and never `req.Trailer`. An unauthenticated client can therefore smuggle a sanitized name (an aliasing spelling such as `X_Auth_User`, or a trusted name such as `X-Forwarded-Prefix`) as an HTTP/1.1 chunked trailer or an HTTP/2 trailer: `reject` does not return its documented `400`, `delete` does not remove the name, and Traefik's reverse proxy forwarded the trailer to the backend — with an attacker-chosen value whenever a body-buffering middleware (the `retry` middleware with status codes, or the `buffering` middleware) reads the body before the proxy clone. Backends that merge trailers into their header namespace then act on the smuggled name. The fix stops forwarding request trailer values to the backend; the declared trailer names are still forwarded as permitted by RFC 9110 section 6.6.2.\n\nTraefik v2 is not affected: the defect is in the custom reverse proxy introduced in v3 (`pkg/proxy/httputil`), and v2 uses the","public_affected_ranges":[">= 3.2.0, < 3.7.13"]}],"null_published_at":"2026-11-02T10:00:37.197Z","source_updated_at":"2026-09-10T23:04:22.000Z","source_disclosed_at":"2026-09-10T23:04:21.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T22:54:05.264Z"}],"next_cursor":null,"snapshot_revision":"42594"}