TI-2025-43649 Aliases GHSA-3wqc-mwfx-672p

Traefik affected by Go oauth2/jws Improper Validation of Syntactic Correctness of Input vulnerability

LOW 38CWE-1286Published 2025-04-18 · Updated 2025-07-17

Key facts

Attack vector: —
Privileges required: —
User interaction: —
Attack complexity: —
Impact type: —
Confidentiality · integrity · availability: —
Fix status: Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

### Summary We have encountered a security vulnerability being reported by our scanners for Traefik 2.11.22. - https://security.snyk.io/vuln/SNYK-CHAINGUARDLATEST-TRAEFIK33-9403297 ### Details It seems to target oauth2/jws library. ### PoC No steps to replicate this vulnerability ### Impact We have a strict control on security and we always try to stay up-to-date with the fixes received for third-party solutions. ## Patches - https://github.com/traefik/traefik/releases/tag/v2.11.24 - https://github.com/traefik/traefik/releases/tag/v3.3.6 - https://github.com/traefik/traefik/releases/tag/v3.4.0-rc2

Why it matters now

Fix Fixed github.com/traefik/traefik/v3 (Go): 3.3.6, 3.4.0-rc2github.com/traefik/traefik/v2 (Go): 2.11.24

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	github.com/traefik/traefik/v3 (Go)	before 3.3.6	3.3.6	Patch available	GHSA-3wqc-mwfx-672p
—	github.com/traefik/traefik/v2 (Go)	before 2.11.24	2.11.24	Patch available	GHSA-3wqc-mwfx-672p
—	github.com/traefik/traefik/v3 (Go)	3.4.0-rc1 to before 3.4.0-rc2	3.4.0-rc2	Patch available	GHSA-3wqc-mwfx-672p

github.com/traefik/traefik/v3 (Go) Vendor— Affected before 3.3.6 Fixed in 3.3.6 Patch available GHSA-3wqc-mwfx-672p
github.com/traefik/traefik/v2 (Go) Vendor— Affected before 2.11.24 Fixed in 2.11.24 Patch available GHSA-3wqc-mwfx-672p
github.com/traefik/traefik/v3 (Go) Vendor— Affected 3.4.0-rc1 to before 3.4.0-rc2 Fixed in 3.4.0-rc2 Patch available GHSA-3wqc-mwfx-672p

Remediation

Fix · GHSA-3wqc-mwfx-672p github.com/traefik/traefik/v3 (Go) Fixed in 3.3.6 Advisory →
Fix · GHSA-3wqc-mwfx-672p github.com/traefik/traefik/v2 (Go) Fixed in 2.11.24 Advisory →
Fix · GHSA-3wqc-mwfx-672p github.com/traefik/traefik/v3 (Go) Fixed in 3.4.0-rc2 Advisory →

Timeline

2026-10-03 Threatist record created from GHSA-3wqc-mwfx-672p

References

Other 5

Sources

GHSA-3wqc-mwfx-672p · GitHub Advisory Database · CC BY 4.0

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences