Critical Go HTTP Request Smuggling Vulnerability in Traefik Package
Summary
GHSA-5423-jcjm-2gpv: Traefik affected by Go HTTP Request Smuggling Vulnerability. Affects github.com/traefik/traefik/v2 versions < 2.11.24. Fixed in 2.11.24. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Traefik is an open-source edge router that provides a modern HTTP reverse proxy and load balancer for microservices. It is designed to simplify the deployment of applications by managing the routing of incoming requests to the appropriate services. Traefik supports various backends and integrates seamlessly with container orchestration platforms. However, it is vulnerable to a critical issue related to HTTP request smuggling due to improper handling of chunked transfer encoding.
Vulnerability Detail
The vulnerability arises from the net/http package's acceptance of chunked transfer encoding data containing an invalid chunk-size line that is terminated by a bare LF (Line Feed). This flaw can be exploited when used with a server or proxy that misinterprets the bare LF in a chunk extension as part of the extension. As a result, this could allow an attacker to perform request smuggling, potentially leading to unauthorized access or manipulation of requests. The CVSS score for this vulnerability is 9.1, indicating a critical severity level.
How To Fix
Latest published version: v2.11.60 as of 22 Oct 2026
go get github.com/traefik/traefik/v2@v2.11.60Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.24
This is the first release that contains the fix.
go get github.com/traefik/traefik/v2@v2.11.24Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional validation on incoming requests to ensure that chunked transfer encoding is correctly formatted. This may involve filtering out requests with invalid chunk sizes or configuring your server to reject such requests until the package can be updated.
Conclusion
The Go HTTP request smuggling vulnerability in the Traefik package poses a significant risk to applications utilizing this software. It is crucial to update to the latest patched versions to mitigate the risk of exploitation. Additionally, employing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for github.com/traefik/traefik/v2 →
FAQ
HTTP request smuggling is an attack technique that exploits discrepancies in the way different servers or proxies interpret HTTP requests, allowing an attacker to send malicious requests that can bypass security controls.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your Gopkg.lock file, you can check for vulnerabilities without needing to access the code or install anything.
If exploited, this vulnerability could allow attackers to smuggle requests, potentially leading to unauthorized access to sensitive data, session hijacking, or other malicious activities.
Yes, implementing strict validation on incoming requests and rejecting those with invalid chunk sizes can help mitigate the risk until the patch is applied.
The CVSS score for this vulnerability is 9.1, indicating a critical severity level that requires immediate attention.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/traefik/traefik/v2.
