{"items":[{"id":"NVI-00015273","kind":"vulnerability","title":"Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-3ccp-42pg-hgv6","CVE-2026-71324"],"plain_summary":"GitHub lists this reviewed advisory for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3, github.com/traefik/traefik/v3, github.com/traefik/traefik. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4f32a972adc20f0d21c32416c4d1edf2"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4f32a972adc20f0d21c32416c4d1edf2","url":"https://github.com/advisories/GHSA-3ccp-42pg-hgv6","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-3ccp-42pg-hgv6","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T02:28:46.523Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4f32a972adc20f0d21c32416c4d1edf2"],"technology":"github.com/traefik/traefik/v2","known_exclusions":[],"conditions_summary":"## Summary\n\nThere is a critical vulnerability in Traefik's default HTTP reverse proxy that leads to unauthenticated cross-user response poisoning. When a client opens an HTTP/2 or HTTP/3 `CONNECT` request, Traefik forwards it — body included — to an HTTP/1.1 upstream over a shared `net/http.Transport`. If the upstream answers the CONNECT with a keep-alive non-2xx response without draining the body, the now-desynchronized backend socket is returned to Traefik's shared connection pool and reused for other clients, letting an attacker make a different client read a response the attacker smuggled — which may be another user's authenticated or private content. The entrypoint's `sanitizePath` option (default `true`) is not a reliable defense: backends that answer `CONNECT /` with a keep-alive non-2xx remain exploitable. The experimental FastProxy implementation was not affected. The issue is fixed by deferring the forwarded CONNECT payload until the backend accepts the tunnel, by not returning CONNECT connections to the shared idle pool, and by discarding the CONNECT body in the ForwardAuth path.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.53\n- https://github.com","public_affected_ranges":["<= 2.11.52"]},{"certainty":"source_listed","source_ids":["sr-4f32a972adc20f0d21c32416c4d1edf2"],"technology":"github.com/traefik/traefik/v3","known_exclusions":[],"conditions_summary":"## Summary\n\nThere is a critical vulnerability in Traefik's default HTTP reverse proxy that leads to unauthenticated cross-user response poisoning. When a client opens an HTTP/2 or HTTP/3 `CONNECT` request, Traefik forwards it — body included — to an HTTP/1.1 upstream over a shared `net/http.Transport`. If the upstream answers the CONNECT with a keep-alive non-2xx response without draining the body, the now-desynchronized backend socket is returned to Traefik's shared connection pool and reused for other clients, letting an attacker make a different client read a response the attacker smuggled — which may be another user's authenticated or private content. The entrypoint's `sanitizePath` option (default `true`) is not a reliable defense: backends that answer `CONNECT /` with a keep-alive non-2xx remain exploitable. The experimental FastProxy implementation was not affected. The issue is fixed by deferring the forwarded CONNECT payload until the backend accepts the tunnel, by not returning CONNECT connections to the shared idle pool, and by discarding the CONNECT body in the ForwardAuth path.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.53\n- https://github.com","public_affected_ranges":["<= 3.6.23"]},{"certainty":"source_listed","source_ids":["sr-4f32a972adc20f0d21c32416c4d1edf2"],"technology":"github.com/traefik/traefik/v3","known_exclusions":[],"conditions_summary":"## Summary\n\nThere is a critical vulnerability in Traefik's default HTTP reverse proxy that leads to unauthenticated cross-user response poisoning. When a client opens an HTTP/2 or HTTP/3 `CONNECT` request, Traefik forwards it — body included — to an HTTP/1.1 upstream over a shared `net/http.Transport`. If the upstream answers the CONNECT with a keep-alive non-2xx response without draining the body, the now-desynchronized backend socket is returned to Traefik's shared connection pool and reused for other clients, letting an attacker make a different client read a response the attacker smuggled — which may be another user's authenticated or private content. The entrypoint's `sanitizePath` option (default `true`) is not a reliable defense: backends that answer `CONNECT /` with a keep-alive non-2xx remain exploitable. The experimental FastProxy implementation was not affected. The issue is fixed by deferring the forwarded CONNECT payload until the backend accepts the tunnel, by not returning CONNECT connections to the shared idle pool, and by discarding the CONNECT body in the ForwardAuth path.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.53\n- https://github.com","public_affected_ranges":[">= 3.7.0, <= 3.7.8"]},{"certainty":"source_listed","source_ids":["sr-4f32a972adc20f0d21c32416c4d1edf2"],"technology":"github.com/traefik/traefik","known_exclusions":[],"conditions_summary":"## Summary\n\nThere is a critical vulnerability in Traefik's default HTTP reverse proxy that leads to unauthenticated cross-user response poisoning. When a client opens an HTTP/2 or HTTP/3 `CONNECT` request, Traefik forwards it — body included — to an HTTP/1.1 upstream over a shared `net/http.Transport`. If the upstream answers the CONNECT with a keep-alive non-2xx response without draining the body, the now-desynchronized backend socket is returned to Traefik's shared connection pool and reused for other clients, letting an attacker make a different client read a response the attacker smuggled — which may be another user's authenticated or private content. The entrypoint's `sanitizePath` option (default `true`) is not a reliable defense: backends that answer `CONNECT /` with a keep-alive non-2xx remain exploitable. The experimental FastProxy implementation was not affected. The issue is fixed by deferring the forwarded CONNECT payload until the backend accepts the tunnel, by not returning CONNECT connections to the shared idle pool, and by discarding the CONNECT body in the ForwardAuth path.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.53\n- https://github.com","public_affected_ranges":["<= 1.7.34"]}],"null_published_at":"2026-11-03T10:03:26.566Z","source_updated_at":"2026-08-06T15:56:42.000Z","source_disclosed_at":"2026-08-06T15:56:40.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T02:28:46.523Z"}],"next_cursor":null,"snapshot_revision":"42594"}