CVE-2026-71324 Details
Description
Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNECT with a keep-alive non-2xx response and does not drain the body, Traefik returns the desynchronized backend socket to its shared pool and reuses it for other clients. An unauthenticated attacker can use this behavior to make a different client read the attacker's smuggled response, which can include authenticated or private content from another request. The ForwardAuth middleware with forwardBody true and preserveRequestMethod true can re-issue a CONNECT with the buffered body attached, exposing the auth-client pool to the same desynchronization. This issue is fixed in 2.11.53, 3.6.24, and 3.7.9.
A cross-user response poisoning vulnerability has been identified in Traefik's default HTTP reverse proxy behavior, affecting versions through 2.11.52, versions 3.0.0 prior to 3.6.24, and versions 3.7.0 prior to 3.7.9. The issue arises when an HTTP/2 or HTTP/3 CONNECT request is forwarded to an HTTP/1.1 upstream via a shared net/http.Transport. If the upstream responds with a keep-alive non-2xx status without draining the response body, the desynchronized backend socket is returned to the shared pool and can be reused for other clients. This allows an attacker to smuggle a response into a different client's session, potentially leaking authenticated or private information. The vulnerability is present in the ForwardAuth middleware when certain options are enabled, allowing the smuggled response to be forwarded to the auth-client pool, where it can cause the same desynchronization issue.
Users can upgrade to Traefik versions 2.11.53, 3.6.24, or 3.7.9 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| traefik traefik | < 2.11.53 >= 3.0.0, < 3.6.24 >= 3.7.0, < 3.7.9 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | Initial Analysis | [email protected] |
| Aug 7, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |