Traefik vulnerabilities

In Traefik prior to versions 2.11.38 and 3.6.9, a vulnerability exists in TLS handshake management on TCP routers. An unauthenticated attacker can send an incomplete TLS record and stop transmission, causing the handshake to stall indefinitely and holding connections open.

A vulnerability in Traefik before version 3.6.8 allows an unauthenticated client to bypass the readTimeout by sending an 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely and leading to a denial of service.

Traefik versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to "on" (intending to enable backend TLS certificate verification) actually disables verification. This allows man-in-the-middle attacks against HTTPS backends when operators believe they are protected. The issue is fixed in version 3.6.3.

Traefik, an HTTP reverse proxy and load balancer, in versions prior to 2.11.32 and 2.11.31 through 3.6.2 allows requests using PathPrefix, Path or PathRegex matchers to bypass path normalization. Requests containing URL-encoded restricted characters (/, \, Null, ;, ?, #) can bypass the middleware chain and reach unintended backends. This is fixed in versions 2.11.32 and 3.6.3.