Read the docs
TI-2025-43650 Aliases GHSA-5423-jcjm-2gpv

Traefik affected by Go HTTP Request Smuggling Vulnerability

Priority LOW 38CWE-1395Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

### Summary net/http: request smuggling through invalid chunked data: The net/http package accepts data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permit request smuggling. [CVE-2025-22871] Vendor Affected Components: Go: 1.23.x < 1.23.8 More Details: [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) ## Patches - https://github.com/traefik/traefik/releases/tag/v2.11.24 - https://github.com/traefik/traefik/releases/tag/v3.3.6 - https://github.com/traefik/traefik/releases/tag/v3.4.0-rc2

Why it matters now

Fix Fixed github.com/traefik/traefik/v2 (Go): 2.11.24github.com/traefik/traefik/v3 (Go): 3.3.6, 3.4.0-rc2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—github.com/traefik/traefik/v2 (Go)before 2.11.242.11.24Patch availableGHSA-5423-jcjm-2gpv
—github.com/traefik/traefik/v3 (Go)before 3.3.63.3.6Patch availableGHSA-5423-jcjm-2gpv
—github.com/traefik/traefik/v3 (Go)3.4.0-rc1 to before 3.4.0-rc23.4.0-rc2Patch availableGHSA-5423-jcjm-2gpv
  • github.com/traefik/traefik/v2 (Go) Vendor— Affected before 2.11.24 Fixed in 2.11.24 Patch available GHSA-5423-jcjm-2gpv
  • github.com/traefik/traefik/v3 (Go) Vendor— Affected before 3.3.6 Fixed in 3.3.6 Patch available GHSA-5423-jcjm-2gpv
  • github.com/traefik/traefik/v3 (Go) Vendor— Affected 3.4.0-rc1 to before 3.4.0-rc2 Fixed in 3.4.0-rc2 Patch available GHSA-5423-jcjm-2gpv

Remediation

  • Fix · GHSA-5423-jcjm-2gpv github.com/traefik/traefik/v2 (Go) Fixed in 2.11.24 Advisory →
  • Fix · GHSA-5423-jcjm-2gpv github.com/traefik/traefik/v3 (Go) Fixed in 3.3.6 Advisory →
  • Fix · GHSA-5423-jcjm-2gpv github.com/traefik/traefik/v3 (Go) Fixed in 3.4.0-rc2 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-5423-jcjm-2gpv

References

Advisory 1

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences